Privacy Policy

01 Introduction

This Privacy Policy ("Policy") is issued by TotoSlot ("TotoSlot", "we", "us", "our"), the operator of the online gaming platform located at totoslot.casa. This Policy describes how TotoSlot collects, uses, stores, shares, and protects the personal data of individuals ("you", "User", "Player") who access or use the TotoSlot platform, including the website, any associated mobile interface, and all services and products offered therein.

TotoSlot is operated under an international gaming licence and processes personal data in accordance with the requirements imposed by that licence, applicable data protection legislation, and the anti-money laundering (AML) and know-your-customer (KYC) obligations placed on licensed gaming operators.

By registering an account on TotoSlot, by depositing funds, or by otherwise using the Platform, you confirm that you have read and understood this Privacy Policy and that you consent to the collection and use of your personal data as described herein. If you do not agree with the terms of this Policy, please do not use the TotoSlot platform.

02 Definitions

In this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information that identifies or could reasonably be used to identify a specific natural person, directly or indirectly, including but not limited to a name, identification number, location data, email address, phone number, or financial account details.
• "Processing" means any operation performed on Personal Data, whether or not by automated means — including collection, recording, storage, use, disclosure, deletion, and any other form of handling.
• "Data Controller" means TotoSlot, as the entity that determines the purposes and means of Processing your Personal Data.
• "Data Processor" means a third party that processes Personal Data on behalf of TotoSlot under a contractual arrangement and in accordance with TotoSlot's instructions.
• "KYC" (Know Your Customer) means the identity verification and due diligence process required by TotoSlot's licensing and AML obligations, involving the collection and verification of identity documents and other personal information.
• "Cookies" means small text files placed on your device by the TotoSlot website to store preference information and facilitate session management.
• "Platform" means the TotoSlot website at totoslot.casa and all associated gaming services, content, and tools.

03 Personal Data We Collect

TotoSlot collects the following categories of personal data in the course of operating the Platform and providing services to registered Users:

04 How We Collect Your Data

TotoSlot collects personal data through the following means:

• Direct provision by you: When you register an account, complete KYC verification, make a deposit or withdrawal request, contact our support team, or respond to a survey or promotional enquiry.
• Automated collection: When you access the Platform, our servers and analytics tools automatically collect Technical Data including your IP address, browser fingerprint, and session information. Cookies collect preference and session management data.
• Payment service providers: When you deposit or withdraw via Touch 'n Go eWallet, Boost eWallet, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, or other supported payment channels, our payment processors share transaction confirmation data with TotoSlot.
• Third-party identity verification services: Where TotoSlot uses third-party KYC service providers to assist with document verification, those providers may share verification results and data quality scores with us.
• Regulatory and law enforcement bodies: In limited circumstances, TotoSlot may receive information about you from regulatory authorities or law enforcement agencies in connection with investigations or compliance requirements.

05 Legal Basis for Processing

TotoSlot processes your personal data on one or more of the following legal bases, depending on the specific processing activity in question:

• Contractual Necessity: Processing is necessary to perform the contract between you and TotoSlot — that is, to register and maintain your account, process deposits and withdrawals in MYR, settle bets, award bonuses, and provide customer support.
• Legal Obligation: Processing is required to comply with legal and regulatory obligations, including KYC/AML verification requirements imposed by TotoSlot's gaming licence, financial crime prevention obligations, and record-keeping requirements.
• Legitimate Interests: Processing is carried out in pursuit of TotoSlot's legitimate business interests, including fraud detection and prevention, platform security, responsible gambling monitoring, and service improvement — where those interests are not overridden by your rights.
• Consent: Where we rely on your consent for specific processing activities (for example, sending you promotional communications beyond transactional notifications), you may withdraw that consent at any time by contacting our support team or updating your account communication preferences.

06 How We Use Your Personal Data

TotoSlot uses the personal data we collect for the following purposes:

• To create, manage, and maintain your TotoSlot account, including processing your registration information and verifying your identity through KYC procedures.
• To process deposits and withdrawals in Malaysian Ringgit (MYR) via your chosen payment method, including Touch 'n Go eWallet, Boost, DuitNow, FPX, and bank transfers.
• To settle sports bets, casino wagers, and bonus transactions on the Platform.
• To communicate with you regarding your account, including transaction confirmations, account security alerts, and responses to customer support enquiries.
• To detect, investigate, and prevent fraud, money laundering, account manipulation, bonus abuse, and other prohibited activities.
• To comply with AML and KYC requirements, including reporting suspicious transactions to the relevant authorities where legally required.
• To administer our responsible gambling programme, including monitoring for problem gambling indicators, applying deposit limits or self-exclusion measures where requested, and fulfilling our duty of care obligations.
• To analyse platform usage patterns, improve the performance and content of the Platform, and personalise your gaming experience where appropriate.
• To contact you with promotional offers, bonus notifications, and VIP programme updates where you have not opted out of such communications.
• To comply with any other legal, regulatory, or licensing obligation applicable to TotoSlot.

07 Data Sharing & Disclosure

TotoSlot does not sell, rent, or trade your personal data to any third party. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection obligations:

• Payment Service Providers: To process deposits and withdrawals, TotoSlot shares necessary financial data with payment processors supporting Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and other payment methods. These providers act as data processors under contract with TotoSlot.
• KYC and Identity Verification Partners: Where TotoSlot engages third-party identity verification services, your identity documents and personal data may be shared with those providers solely for the purpose of verifying your identity and conducting AML checks.
• Game Studio Technology Partners: Game outcome data and session identifiers may be shared with our licensed game studio partners to facilitate gameplay, track RTP compliance, and resolve disputes. These partners do not receive your personal identity data.
• IT and Infrastructure Providers: Cloud hosting, database management, and cybersecurity service providers who process data on TotoSlot's behalf under strict contractual data protection terms.
• Regulatory and Law Enforcement Authorities: TotoSlot is legally required to disclose personal data to relevant regulatory bodies, financial intelligence units, or law enforcement agencies where mandated by law, by court order, or by TotoSlot's licensing conditions — for example, in connection with an AML investigation or a suspicious activity report.
• Professional Advisors: Lawyers, auditors, and compliance consultants who are bound by confidentiality obligations and who access personal data only as necessary to provide professional services to TotoSlot.

08 International Data Transfers

As an internationally licensed online gaming platform, TotoSlot may process and store personal data on servers located outside of Malaysia. Where personal data is transferred to jurisdictions that do not provide an equivalent level of data protection to Malaysia, TotoSlot will ensure that appropriate safeguards are in place, which may include:

• Standard contractual clauses approved by the relevant regulatory authority.
• Contractual obligations placing data protection requirements on the receiving party equivalent to those imposed on TotoSlot.
• Transfers to countries that the relevant regulatory authority has recognised as providing an adequate level of data protection.

By using the TotoSlot platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside of Malaysia, subject to the safeguards described above.

09 Data Retention

TotoSlot retains personal data for only as long as is necessary to fulfil the purposes for which it was collected, to comply with legal obligations, or to defend against legal claims. Specific retention periods applicable to TotoSlot's data categories are as follows:

• Account and Identity Data: Retained for the duration of your active account relationship with TotoSlot and for a minimum of five (5) years following account closure, as required by applicable AML legislation.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification, or longer where required by regulatory direction.
• Financial Transaction Records: Retained for a minimum of five (5) years in line with financial record-keeping obligations. This includes all MYR deposit, withdrawal, and wagering records.
• Customer Support Communications: Retained for three (3) years from the date of the interaction, unless the subject matter requires longer retention for legal or compliance reasons.
• Technical and Log Data: Typically retained for twelve (12) months from collection, unless extended retention is necessary for security investigation purposes.
• Marketing Consent Records: Retained until consent is withdrawn, and for one (1) year following withdrawal as evidence of the prior consent status.

Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents recovery or re-identification.

10 Cookies & Tracking Technologies

TotoSlot uses cookies and similar tracking technologies on the totoslot.casa website. Cookies are small text files stored on your device by your browser. They allow the Platform to recognise your device on subsequent visits and to maintain session continuity.

TotoSlot uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies manage your login session, maintain your game state, and process your transactions. They cannot be disabled without breaking core platform functionality.
• Performance and Analytics Cookies: Used to collect anonymised data about how visitors use the Platform — including which pages are visited most frequently and where users encounter errors. This information helps us improve the Platform. Data is aggregated and does not identify individual users.
• Functional Cookies: Store your preferences such as language selection, display settings, and notification options. These cookies are not strictly necessary but improve your experience on return visits.

You can control cookie settings through your browser. Most modern browsers allow you to refuse all cookies, accept only certain categories, or delete existing cookies. Please note that disabling strictly necessary cookies may impair your ability to use the Platform. For guidance on managing cookies in your specific browser, consult your browser's help documentation.

11 Security Measures

TotoSlot implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• AES-256 Encryption at Rest: All personal data stored in TotoSlot's databases is encrypted using AES-256 standard encryption, ensuring that data is unreadable without the corresponding decryption keys.
• TLS 1.3 Encryption in Transit: All data transmitted between your browser and the totoslot.casa servers is encrypted using TLS 1.3 protocol, preventing interception during transmission.
• Access Controls: Access to personal data within TotoSlot's systems is restricted to authorised personnel on a strict need-to-know basis. Role-based access controls are enforced, and privileged access is logged and monitored.
• Multi-Factor Authentication: Internal system access for TotoSlot personnel is protected by multi-factor authentication requirements.
• Security Monitoring: TotoSlot operates continuous monitoring systems that detect and alert on anomalous access patterns, potential data breaches, and suspicious account activity.
• Regular Security Audits: The Platform undergoes periodic security assessments and penetration testing conducted by qualified independent security professionals.

In the event of a personal data breach that is likely to result in risk to your rights, TotoSlot will notify affected individuals and the relevant supervisory authority in accordance with applicable data breach notification obligations.

12 Your Data Rights

Subject to applicable law and the legitimate operational and legal requirements of TotoSlot as a licensed gaming operator, you hold the following rights in relation to your personal data:

• Right of Access: You have the right to request a copy of the personal data that TotoSlot holds about you, together with information about how that data is being used.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data be corrected. You may update certain account details directly within your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other legal basis applies), or where processing is unlawful. Note that TotoSlot is legally required to retain certain data — particularly KYC and transaction records — for a minimum period, and erasure requests that conflict with these obligations cannot be fully honoured during the mandatory retention period.
• Right to Restriction of Processing: You may request that TotoSlot restrict the processing of your personal data in certain circumstances — for example, while a dispute regarding the accuracy of your data is being resolved.
• Right to Data Portability: Where processing is based on contract or consent and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, or to processing for direct marketing purposes. Where you object to direct marketing, TotoSlot will cease such communications without delay.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact TotoSlot's support team via live chat or by emailing [email protected] (plain text — not a clickable link). We will respond to all data rights requests within thirty (30) days of receipt. Complex requests may require an extension of up to an additional sixty (60) days, in which case you will be informed of the extension and the reason for it.

13 Children's Privacy

The TotoSlot platform is strictly restricted to individuals aged 21 years and above. TotoSlot does not knowingly collect, use, or retain personal data from individuals under the age of 21. Any account found to be held by a person under the age of 21 will be immediately closed and all associated data handled in accordance with TotoSlot's data retention and security obligations.

If you are a parent or guardian and have reason to believe that a minor has registered an account or provided personal data to TotoSlot without your consent, please contact our support team immediately. TotoSlot will investigate the matter and take appropriate action, including the deletion of data associated with the underage account where legally permissible.

14 Third-Party Links & Services

The TotoSlot platform may contain functional references to third-party payment service providers (such as Touch 'n Go eWallet, Boost, or GrabPay) in the course of processing your transactions. When you interact with those payment services, you will be subject to their respective privacy policies and terms of service. TotoSlot is not responsible for the privacy practices of those third parties.

Where TotoSlot provides links to external pages (for example, within responsible gambling resources), those linked websites operate independently and have their own privacy policies. TotoSlot recommends that you review the privacy policy of any third-party website you visit.

15 Amendments to This Policy

TotoSlot reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable law or regulatory guidance, or improvements to the Platform. The effective date of the current version is displayed prominently at the top of this page.

Where changes to this Policy are material — meaning they significantly affect your rights or the way in which we process your personal data — TotoSlot will notify registered Users by email and/or by displaying a prominent notice on the Platform prior to the changes taking effect. Non-material updates (for example, corrections to typographical errors or improvements to clarity) may be made without individual notification.

The most current version of this Privacy Policy is always available at totoslot.casa/privacy-policy. Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acknowledgement of the revised terms.

16 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by TotoSlot, please contact us through any of the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly on the TotoSlot platform. Supported in English, Bahasa Melayu, and Chinese. Average response time via live chat: 3 to 5 minutes.
• Email: [email protected] — please note this is displayed as plain text only and is not a clickable link. Responses within 2 business hours for standard enquiries; data rights requests are handled within 30 calendar days.
• WhatsApp: Contact number available within your member account dashboard after login.

For requests to exercise your data rights (access, correction, deletion, portability, objection), please provide your full registered name and account email address when contacting us, so that we can verify your identity and locate your records efficiently.

For questions relating to our responsible gambling tools and self-exclusion processes, please visit our dedicated Responsible Gambling page.

For questions relating to our general platform terms, please refer to our Terms & Conditions.