Privacy Policy

This Privacy Policy ("Policy") is issued by toto12 ("the Platform", "we", "us", "our"), the operator of the online gaming and sports betting website accessible at https://toto12.casa. This Policy explains how toto12 collects, processes, stores, and protects the personal data of individuals ("you", "Player", "User") who access or register on the Platform.

toto12 is committed to handling personal data responsibly and in accordance with applicable international data protection standards. By registering on or continuing to use the toto12 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

This Policy should be read together with our Terms & Conditions and our Responsible Gambling Policy, both of which form part of the overall agreement governing your use of the toto12 platform.

For the purposes of this Policy, the following terms shall have the meanings ascribed below:

• "Personal Data" — any information that identifies or could reasonably identify a living individual, either directly or in combination with other data held by toto12.
• "Processing" — any operation performed on personal data, including but not limited to collection, recording, storage, use, transmission, alteration, blocking, erasure, or destruction.
• "Controller" — toto12, as the entity that determines the purposes and means of processing personal data collected through the Platform.
• "Data Subject" — the individual to whom personal data relates; in this context, any registered or prospective Player.
• "KYC" — Know Your Customer; the identity and age verification process required before a Player may process withdrawals from their account.
• "Cookies" — small text files stored on a User's device by the Platform to enable and enhance website functionality, analytics, and personalisation.
• "Third Party" — any entity other than toto12 and the Data Subject, including payment processors, analytics providers, and regulatory bodies.

toto12 collects personal data through several channels, including account registration, payment transactions, KYC verification, customer support interactions, and automated platform activity tracking. The categories of data we collect include:

toto12 does not collect sensitive personal data categories (such as racial origin, health data, or biometric data) except where identity documents incidentally contain such information as part of standard government-issued document formats. Such incidental data is not extracted, stored separately, or processed for any purpose other than identity verification.

toto12 processes your personal data for the following purposes:

1. Account Management: To create, administer, and maintain your registered Player Account, including authentication and access control.
2. Payment Processing: To facilitate MYR deposits and withdrawals via your chosen payment method — including Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, and supported cryptocurrencies.
3. Identity Verification (KYC): To verify your identity and age (minimum 21 years) in compliance with international gaming licence obligations, and to fulfil anti-money laundering (AML) and counter-terrorism financing (CTF) requirements.
4. Platform Delivery: To provide sports betting, live casino, slot, and other gaming services accessible through the toto12 Platform.
5. Customer Support: To respond to your enquiries, resolve disputes, and manage complaints in an efficient and documented manner.
6. Responsible Gambling: To monitor for indicators of problem gambling behaviour, implement deposit or loss limits, enforce self-exclusion requests, and comply with responsible gaming obligations.
7. Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, unauthorised access, money laundering, bonus abuse, and other prohibited activities.
8. Legal Compliance: To comply with applicable laws, regulatory directives, court orders, or requests from competent governmental or law enforcement authorities.
9. Platform Improvement: To analyse aggregated, anonymised usage patterns to improve platform performance, user experience, and product development.
10. Communications: To send you service-related notifications, security alerts, and — where you have provided explicit consent — promotional communications about toto12 offers and promotions.

toto12 processes personal data only where a valid legal basis exists. The primary legal bases relied upon are as follows:

• Contractual Necessity: Processing is necessary for the performance of the Player Account agreement between you and toto12, including account setup, payment processing, and gaming service delivery.
• Legal Obligation: Processing is required to comply with applicable legal and regulatory obligations, including KYC/AML requirements imposed by toto12's gaming licence conditions.
• Legitimate Interests: Processing is necessary for toto12's legitimate interests, including platform security, fraud prevention, and responsible gambling monitoring, provided these interests are not overridden by your data protection rights.
• Consent: Where processing is based on consent — such as receiving marketing communications — you may withdraw that consent at any time by contacting toto12 support.

toto12 does not sell your personal data to third parties. We may share your data with the following categories of recipient only where strictly necessary for the purposes outlined in this Policy:

• Payment Service Providers: Banks, e-wallet operators (including providers of Touch 'n Go eWallet, Boost, and GrabPay infrastructure), and payment gateway processors facilitate your MYR transactions. These providers act as independent data controllers in respect of their own payment processing activities.
• KYC & Identity Verification Providers: Third-party services that assist toto12 in verifying identity documents and performing age verification checks.
• IT Infrastructure Providers: Cloud hosting, data storage, and cybersecurity providers that process data solely on toto12's instructions under data processing agreements.
• Game Studios: Licensed game content providers who may receive anonymised session data to enable game functionality. These providers do not receive personally identifiable information.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, or a competent governmental authority, toto12 may disclose personal data without prior notice to the Data Subject.
• Fraud Prevention Agencies: Where toto12 has reasonable grounds to suspect financial crime, relevant data may be shared with anti-fraud bodies or financial intelligence units as required.

toto12 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulatory obligation. The following general retention principles apply:

• Active Account Data: Personal data associated with a registered, active Player Account is retained for the duration of the account's existence and for a minimum of five (5) years following account closure.
• KYC Documentation: Identity verification documents are retained for a minimum of five (5) years from the date of submission, in accordance with standard anti-money laundering record-keeping obligations under international gaming licensing frameworks.
• Transaction Records: Financial transaction history, including MYR deposit and withdrawal records, is retained for a minimum of five (5) years.
• Customer Support Records: Support communications and complaint records are retained for three (3) years from the date of the final interaction.
• Technical Logs: Server and access logs are retained for a maximum of twelve (12) months, after which they are securely deleted or anonymised.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised such that it can no longer be attributed to any identified individual.

toto12 uses cookies and similar tracking technologies on the Platform. These are small data files stored on your browser or device that help us operate and improve the website. The types of cookies we use are as follows:

• Essential Cookies: Required for the Platform to function correctly, including maintaining your logged-in session, remembering language preferences, and enabling secure payment flows. These cookies cannot be disabled without impairing core platform functionality.
• Analytical Cookies: Used to collect aggregated, anonymised data about how Players navigate and use the Platform — including which pages are visited most frequently, how long sessions last, and where users exit the site. This data helps toto12 improve platform design and performance.
• Functional Cookies: Enable enhanced functionality and personalisation, such as remembering your preferred deposit method or game category settings between sessions.
• Security Cookies: Used to detect and prevent fraudulent activity, such as identifying unusual login patterns or high-risk session behaviours.

You can control or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the toto12 Platform. For detailed instructions on managing cookies in your specific browser, please refer to your browser's official help documentation.

toto12 implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. Our security measures include:

• SSL/TLS Encryption: All data transmitted between your device and the toto12 Platform is encrypted using 256-bit SSL/TLS protocols, preventing interception during transit.
• Data Encryption at Rest: Sensitive data — including identity documents submitted for KYC verification and financial account information — is encrypted while stored on our servers.
• Access Controls: Access to personal data within toto12's systems is restricted on a strict need-to-know basis. All staff with access to Player data are subject to confidentiality obligations.
• Two-Factor Authentication: toto12 supports two-factor authentication (2FA) for Player Accounts to reduce the risk of unauthorised access through compromised credentials.
• Regular Security Assessments: toto12 conducts periodic reviews of its information security policies, infrastructure, and procedures to identify and remediate potential vulnerabilities.

Notwithstanding these measures, no data transmission over the internet or electronic storage system can be guaranteed as completely secure. In the event of a material data breach that is likely to result in a risk to your rights and freedoms, toto12 will notify affected Data Subjects in accordance with applicable notification obligations.

Subject to applicable law and certain limited exceptions, you have the following rights in relation to the personal data toto12 holds about you:

To exercise any of the rights above, please contact toto12 using the contact details provided in Section 14 of this Policy. We may require you to verify your identity before fulfilling any data rights request to ensure that data is not disclosed to an unauthorised party.

The toto12 Platform is strictly intended for individuals who are aged 21 years or above. toto12 does not knowingly collect personal data from individuals under the age of 21. The registration process includes age declaration, and KYC verification is used to confirm this requirement.

If toto12 discovers or has reasonable grounds to believe that personal data has been submitted by a person under 21 years of age, the associated Account will be suspended immediately, all data will be reviewed, and the Account will be permanently closed. Any deposits associated with underage accounts will be returned to the payment source following investigation.

toto12 operates under an international gaming licence and may process or store personal data on servers located outside of Malaysia. Where personal data is transferred to countries that may not provide the same level of data protection as Malaysia's PDPA, toto12 ensures that appropriate safeguards are in place — including contractual data processing agreements with service providers that incorporate internationally recognised data protection standards.

By registering on the toto12 Platform, Malaysian players acknowledge and consent to the transfer of their personal data to servers and processors located in other jurisdictions for the purposes outlined in this Policy, subject to the safeguards described above.

toto12 reserves the right to update or amend this Privacy Policy at any time to reflect changes in platform operations, applicable law, or data processing practices. When material changes are made, we will notify registered Players by email and/or through a prominent notice on the Platform at least 7 calendar days before the changes take effect.

Your continued use of the toto12 Platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of and agreement to the updated terms. The "Last Updated" date at the top of this document reflects the current version.

We encourage you to review this Policy periodically to remain informed about how toto12 collects, uses, and protects your personal data.

For any questions, concerns, or requests relating to this Privacy Policy or the personal data toto12 holds about you, please contact our Data Protection team:

Email:
[email protected]  (plain text — not a clickable link)

Subject Line: Please use the subject line "Privacy Policy Enquiry" or "Data Rights Request" so that your message is directed to the appropriate team. All verified requests will receive an acknowledgement within 5 business days and a substantive response within 30 calendar days.

For responsible gambling enquiries, self-exclusion requests, or deposit/loss limit adjustments, please visit our Responsible Gambling page. For general platform questions, our FAQ page may have the answer you're looking for.