Privacy Policy

This Privacy Policy ("Policy") is issued by Toto77 ("we", "us", "our", "the Platform") and governs the collection, processing, storage, and disclosure of personal data relating to individuals ("you", "Player", "User") who access and use the Toto77 online gaming platform at https://toto77.lat and any associated mobile web services.

Toto77 operates an English-language online casino and sports betting platform serving Malaysian players and users in other permitted jurisdictions. All financial transactions on the platform are conducted in Malaysian Ringgit (MYR). As part of delivering this service, Toto77 necessarily processes certain categories of personal data as described in this Policy.

Toto77 is committed to handling your personal data with care, transparency, and in compliance with applicable international data protection frameworks. We do not treat your data as a secondary matter — how we handle your personal information is a direct reflection of the trust you place in us as a platform.

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person — including but not limited to name, email address, phone number, date of birth, payment details, and IP address.
• "Processing" means any operation performed on personal data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" means the entity that determines the purposes and means of processing personal data — in this case, Toto77.
• "Data Processor" means any third party that processes personal data on behalf of Toto77 under contract, such as payment processors, KYC verification providers, and cloud infrastructure providers.
• "Consent" means any freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data for a stated purpose.
• "Cookie" means a small data file stored on your device by a website for the purpose of tracking session state, preferences, or analytics.
• "KYC" means Know Your Customer — the identity verification process used to confirm a Player's identity and age before enabling full account functionality.
• "Retention Period" means the defined length of time for which Toto77 retains a specific category of personal data before it is deleted or anonymised.

Toto77 collects and processes the following categories of personal data:

3.1 Registration Data

When you create a Toto77 account, we collect: full name, date of birth, email address, mobile phone number, residential address, username, and country of residence.

3.2 Identity Verification (KYC) Data

To comply with anti-money laundering obligations and to verify that you meet the minimum age requirement of 21 years, we collect: copies of government-issued photo identification (such as Malaysian MyKad or passport), proof of residential address documents, and payment method ownership documentation where required.

3.3 Financial & Transaction Data

Toto77 records details of all financial transactions conducted on the platform, including: deposit amounts and dates, withdrawal amounts and processing times, payment method identifiers (e-wallet account references, masked bank account details), and transaction reference numbers. Full payment card or bank account numbers are not stored on Toto77 infrastructure.

3.4 Gaming Activity Data

We record your gaming history on the platform, including: games played, bets placed, wager amounts, game outcomes, bonus usage, and session durations. This data is used for account management, responsible gambling monitoring, and regulatory compliance.

3.5 Technical & Device Data

When you access the platform, we automatically collect: IP address, device type and operating system, browser type and version, session timestamps, referring URL, and general geographic location derived from IP address.

3.6 Communications Data

Records of communications between you and Toto77 — including live chat transcripts, email correspondence, and support ticket histories — are retained for quality assurance, dispute resolution, and regulatory purposes.

Toto77 collects personal data through the following mechanisms:

• Direct submission: Information you provide when registering an account, completing KYC verification, making deposits or withdrawals, contacting support, or participating in promotions.
• Automated collection: Technical and device data collected automatically when you access the platform, through server logs, session tracking, and analytics tools.
• Cookies and similar technologies: Data collected via cookies, pixel tags, and local storage as described in Section 8 of this Policy.
• Third-party verification services: Identity and age verification data from KYC processing partners, where applicable.
• Payment processors: Transaction confirmation data from Malaysian payment channels including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX-connected banks (Maybank, CIMB, Public Bank, RHB, Hong Leong).

Toto77 processes personal data only where a valid legal basis exists. The table below outlines the primary legal bases on which we rely for our principal processing activities:

Where processing is based on consent, you may withdraw that consent at any time by contacting Toto77 support or updating your account communication preferences. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.

Toto77 uses the personal data it collects for the following purposes:

• Account creation and authentication: To create, verify, and maintain your Toto77 Player account and authenticate your identity on each login.
• Transaction processing: To process your deposits and withdrawal requests through your chosen Malaysian payment method — including Touch 'n Go eWallet, DuitNow, FPX, and other approved channels — and to maintain accurate financial records of all transactions.
• Age and identity verification: To confirm that you are at least 21 years of age and to verify that the identity information you provided during registration is accurate, consistent with our KYC obligations.
• Regulatory compliance: To fulfil our obligations under applicable anti-money laundering regulations, including the monitoring and reporting of suspicious transactions.
• Responsible gambling: To monitor gaming behaviour for indicators of problem gambling, to implement responsible gambling tools where requested or required, and to enforce self-exclusion requests.
• Customer support: To respond to your enquiries, process account-related requests, and resolve disputes or complaints.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, account compromise, collusion, and other prohibited conduct.
• Platform improvement: To analyse usage patterns, identify technical issues, and improve the functionality and user experience of the Toto77 platform.
• Marketing communications: Where you have provided consent, to send you information about promotions, bonuses, new features, and platform updates. You may opt out of marketing communications at any time.

Toto77 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. We may share personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• KYC and identity verification providers: Third-party services engaged to verify your identity and age as part of our KYC process. These providers act as data processors under contract with Toto77.
• Payment processors: Malaysian payment infrastructure partners — including e-wallet providers and bank gateway operators — who process your financial transactions. These processors receive only the data necessary to complete the transaction.
• Game software providers: Game Providers whose software is hosted on the Toto77 platform may receive anonymised or pseudonymised session data for game performance and analytics purposes.
• Cloud infrastructure providers: Third-party hosting and cloud storage providers who operate the infrastructure on which the Toto77 platform runs. These providers are contractually bound to process data only as directed by Toto77.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or regulatory obligation, Toto77 may disclose personal data to competent authorities. We will notify you of such disclosures where legally permitted to do so.
• Fraud prevention services: Shared industry fraud databases or risk management services used to identify and prevent fraudulent or prohibited activity on the platform.

Toto77 uses cookies and similar tracking technologies to operate the platform, improve user experience, and — where consent is given — to track usage analytics. Below is a summary of the cookie categories used:

You can manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair the functionality of the platform, including the ability to log in and maintain an active session. Non-essential cookie consent can be withdrawn at any time without affecting your ability to use core platform features.

Toto77 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following general retention guidelines apply:

• Account and registration data: Retained for the duration of your account's active status, plus a minimum of five (5) years following account closure, to satisfy AML regulatory record-keeping requirements.
• KYC and identity documents: Retained for a minimum of five (5) years from the date of submission, consistent with anti-money laundering record-keeping obligations. Copies are deleted or securely destroyed at the end of the retention period.
• Transaction records: Retained for a minimum of five (5) years following each transaction, in accordance with financial record-keeping requirements.
• Gaming activity logs: Retained for a minimum of three (3) years from the date of activity, and may be retained longer where regulatory obligations require it or where a dispute is outstanding.
• Customer communications: Support interactions and correspondence are retained for a minimum of two (2) years from the date of the last communication.
• Marketing consent records: Retained for as long as you remain opted in, plus a reasonable period after opt-out to demonstrate prior consent compliance.
• Technical and device logs: Retained for up to twelve (12) months for security and performance monitoring purposes, then deleted or anonymised.

At the end of the applicable retention period, personal data is either securely deleted, anonymised so that it can no longer be linked to an identifiable individual, or archived in a restricted-access format where continued retention is legally required.

Toto77 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption at rest for sensitive stored data including identity documents and financial information.
• Two-factor authentication (2FA) available to all Players to protect account access.
• Access controls limiting internal access to personal data on a strict need-to-know basis, with audit logging of access events.
• Regular security assessments including vulnerability testing and infrastructure reviews.
• Incident response procedures for the identification, containment, and notification of data security incidents.

While Toto77 takes all reasonable steps to protect your personal data, no digital platform can guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, Toto77 will notify affected Players and relevant authorities in accordance with applicable obligations and without undue delay.

Subject to applicable law and certain conditions, you have the following rights in relation to the personal data Toto77 holds about you:

To exercise any of these rights, please contact Toto77 via live chat or by email at [email protected]. Toto77 will respond to verified data rights requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further sixty (60) days, subject to prior notification.

Please note that certain rights may be limited where Toto77 is required to retain data to comply with legal obligations — particularly in relation to AML record-keeping and regulatory compliance. In such cases, we will inform you of the applicable limitation and its basis.

Toto77 strictly prohibits the registration or use of the platform by any individual below the age of 21 years. The platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 21.

All registered accounts are subject to KYC age verification. Where Toto77 discovers that personal data has been collected from or in relation to an individual who is below the age of 21, that data will be promptly deleted, the associated account will be closed, and any balance will be handled in accordance with our Terms & Conditions.

Toto77 operates globally and may process or store personal data on servers located outside of Malaysia. Where personal data is transferred to jurisdictions that do not provide an equivalent level of data protection to the country from which the data originates, Toto77 will implement appropriate safeguards to ensure the security and integrity of the transferred data.

Such safeguards may include contractual data processing agreements incorporating standard contractual clauses, data transfer impact assessments, and technical measures such as encryption. By using the Toto77 platform, you acknowledge that your personal data may be transferred to and processed in jurisdictions outside of Malaysia.

Toto77 reserves the right to update or amend this Privacy Policy at any time. The date of the most recent update is displayed at the top of this page. Where changes to this Policy are material — meaning they significantly affect how your personal data is processed or your rights in relation to it — Toto77 will notify registered Players via email or through a platform notification displayed upon your next login.

We encourage you to review this Policy periodically. Your continued use of the Toto77 platform following notification of any material amendment constitutes your acceptance of the updated Policy. If you do not agree with the amended Policy, you should discontinue use of the platform and may request account closure in accordance with our Terms & Conditions.

For any questions, concerns, or requests relating to this Privacy Policy or the personal data Toto77 holds about you, please contact us through the following channels:

• Live Chat: Available directly on the Toto77 platform, 9:00 AM – 2:00 AM MYT daily. This is the fastest way to reach our support team.
• Email: [email protected] — for formal data rights requests, privacy queries, and written correspondence. Please include "Privacy Request" in the subject line of your email.

Data rights requests submitted via email will be acknowledged within five (5) business days and fully processed within the timeframes set out in Section 11 above. To verify your identity before processing a data rights request, Toto77 may ask you to provide confirmation of your registered account details.