toto313 Privacy Policy

This Privacy Policy ("Policy") describes how toto313 ("the Platform", "we", "us", "our") collects, uses, stores, discloses, and otherwise processes personal data relating to individuals ("you", "Member", "User") who access or use the toto313 online gaming and sports betting platform at https://toto313.buzz, including any associated sub-domains and mobile applications.

toto313 serves members across Malaysia, including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam, and we recognise the importance of handling personal data responsibly and with full transparency. This Policy has been drafted in compliance with applicable data protection principles and our obligations under our gaming licence.

By registering an account, depositing funds, or otherwise using any Service on the toto313 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions.

The following definitions apply throughout this Privacy Policy:

toto313 collects the following categories of personal data from Members and Platform visitors:

toto313 collects personal data through the following means:

• Direct collection: Data you voluntarily provide when registering an account, completing KYC verification, submitting a deposit or withdrawal request, contacting customer support, or participating in a promotion.
• Automated collection: Technical and session data collected automatically when you access the Platform, including IP address, device identifiers, browser information, and interaction data, collected via server logs, cookies, and similar tracking technologies.
• Third-party sources: Identity verification data returned by licensed KYC verification service providers; fraud signals from payment processors; geolocation data from network infrastructure providers. toto313 does not purchase personal data from third-party data brokers.
• Payment processing: Transaction reference data received from Malaysian payment processors, including FPX bank transfer records, DuitNow transfer confirmations, and e-wallet transaction identifiers from Touch 'n Go eWallet, Boost, and GrabPay systems. toto313 receives only the minimum data necessary to confirm and record each transaction.

toto313 processes your personal data for the following specific and legitimate purposes:

• Account creation and management: To register your account, verify your identity, maintain your account profile, and enable secure login.
• Service delivery: To provide gaming and sports betting services, process bets, calculate and pay winnings, and deliver bonus and promotional offers to which you are entitled.
• Payment processing: To process deposits and withdrawals via Malaysian payment methods including Maybank, CIMB, Public Bank, DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and USDT TRC20.
• KYC and AML compliance: To verify your identity and age, monitor transactions for suspicious activity, and fulfil our anti-money-laundering obligations as required under our gaming licence.
• Customer support: To respond to your enquiries, resolve disputes, and maintain records of support interactions for quality and training purposes.
• Responsible gambling: To implement and monitor the deposit limits, self-exclusion orders, and cooling-off periods you request; and to identify Members who may benefit from responsible gambling interventions.
• Security and fraud prevention: To detect and prevent unauthorised account access, fraudulent transactions, bonus abuse, and other prohibited conduct.
• Platform improvement: To analyse aggregated, anonymised usage data to improve Platform performance, user experience, and game selection.
• Marketing communications: To send you promotional offers, bonus notifications, and relevant updates where you have opted in to receive such communications. You may opt out at any time.
• Legal compliance: To comply with applicable laws, respond to lawful requests from regulatory authorities or law enforcement agencies, and defend toto313 in legal proceedings.

toto313 processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to perform the contract between you and toto313 — including account operation, game play, payment processing, and withdrawal handling — is necessary for the performance of that contract.
• Legal obligation: Processing required to comply with our AML, KYC, and gaming licence obligations is undertaken on the basis of legal obligation.
• Legitimate interests: Processing for fraud prevention, security monitoring, responsible gambling compliance, and Platform improvement is undertaken where toto313's legitimate business interests are not overridden by your fundamental rights.
• Consent: Processing for optional marketing communications is undertaken on the basis of your freely given, specific, and informed consent. You may withdraw consent for marketing communications at any time by contacting our support team.

toto313 does not sell, rent, or commercially exploit your personal data to any third party. We may share your personal data with the following categories of third parties strictly for the purposes set out in this Policy:

• Payment processors and e-wallet providers: Providers of Malaysian payment infrastructure — including FPX partner banks, DuitNow, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and cryptocurrency gateway providers — to process your deposit and withdrawal transactions. These providers receive only the minimum data necessary to process each transaction.
• KYC and identity verification providers: Licensed third-party providers that assist in verifying the identity and age of Members as required by our regulatory obligations.
• Game software providers: Our gaming content partners require certain anonymised session and technical data to deliver and troubleshoot game functionality. These providers do not receive your full identity or financial data.
• Cloud infrastructure and hosting providers: Providers of secure cloud server infrastructure on which toto313 data is stored and processed, all subject to contractual data protection obligations.
• Regulatory authorities and law enforcement: Where required by law, court order, or lawful request from a regulatory authority or law enforcement agency, toto313 will disclose personal data to the extent required. We will notify you of any such disclosure to the extent permitted by law.
• Professional advisers: Lawyers, auditors, and compliance advisers acting on toto313's behalf who require access to certain data to perform their professional services, all bound by confidentiality obligations.

All third-party Data Processors engaged by toto313 are required to process personal data solely on our written instructions, to maintain appropriate technical and organisational security measures, and to comply with applicable data protection obligations. toto313 does not permit any third-party processor to use your data for their own independent purposes.

The toto313 Platform uses cookies and similar tracking technologies to enable core Platform functionality, maintain your session, and collect anonymised analytics data to improve performance. The categories of cookies we use are as follows:

• Strictly necessary cookies: Required for the Platform to function correctly. These include session management cookies that keep you logged in during your gaming session. These cookies cannot be disabled without significantly impairing your use of the Platform.
• Functional cookies: Store your language preference, display settings, and responsible gambling limit configurations between sessions.
• Analytics cookies: Collect anonymised data on how Members navigate and interact with the Platform, used to identify usability issues and improve the overall experience. This data is aggregated and not linked to individual Member identities.
• Security cookies: Used to detect and prevent fraudulent activity, unauthorised access attempts, and bot traffic on the Platform.

Most web browsers allow you to control cookie settings through their built-in privacy preferences. You may disable non-essential cookies through your browser settings; however, disabling strictly necessary cookies will prevent you from logging in and using the Platform.

toto313 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security infrastructure includes:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers.
• Encryption at rest for all stored personal and financial data on our cloud infrastructure.
• Two-factor authentication (2FA) for Member account login and for all internal administrative access to production systems.
• Role-based access controls ensuring that only authorised personnel with a legitimate operational need can access Member personal data.
• Regular penetration testing conducted by independent third-party security specialists to identify and remediate vulnerabilities.
• 24/7 security monitoring by our Security Operations Centre, with automated alerts for anomalous account activity, unusual transaction patterns, and potential breach indicators.
• Secure data backup procedures to ensure business continuity and data recovery capability.

Notwithstanding these measures, no data transmission over the internet or storage system can be guaranteed as completely secure. In the event of a personal data breach that poses a risk to your rights, toto313 will notify affected Members and the relevant authorities in accordance with applicable law.

toto313 retains personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law. The following retention principles apply:

• Active account data: Retained for the duration of your active membership plus a minimum period of 5 years following account closure, to comply with AML record-keeping obligations and to defend any potential legal claims.
• KYC verification records: Retained for a minimum of 5 years following the last transaction or account closure date, as required by applicable anti-money-laundering regulations.
• Financial transaction records: Retained for a minimum of 5 years following the transaction date, for tax, regulatory, and audit purposes.
• Gaming activity and bet history: Retained for a period of 3 years from the date of each gaming session, for dispute resolution, responsible gambling monitoring, and audit purposes.
• Customer support records: Retained for 2 years from the date of the last support interaction, for quality assurance and dispute resolution purposes.
• Technical and session logs: Retained for 12 months from the date of collection, for security monitoring and fraud prevention purposes.
• Marketing consent records: Retained for the duration of your opt-in consent plus 2 years following any opt-out, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with toto313's data destruction procedures.

As a toto313 Member, you hold the following rights in relation to your personal data. To exercise any of these rights, please submit a written request to our support team via the contact details in Section 15. We will respond to all verified requests within 30 calendar days.

The toto313 Platform is strictly intended for adults aged 21 years and above. toto313 does not knowingly collect, process, or store personal data relating to any person under 21 years of age.

If toto313 becomes aware that personal data has been collected from a person under the age of 21, that data will be immediately deleted, the associated account will be permanently terminated, and all balances will be forfeited. Any winnings generated by an underage account are void.

If you are a parent or guardian and believe that your child has registered an account on toto313 without your knowledge, please contact us immediately at [email protected] (non-clickable plain text) so that we can investigate and take appropriate action.

As an online gaming platform serving Members primarily in Malaysia, toto313 may transfer certain personal data to third-party service providers whose infrastructure is located outside Malaysia. Such transfers may include data processed by game software providers, cloud hosting providers, and fraud detection systems.

Where personal data is transferred outside Malaysia, toto313 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that provided under this Policy, including:

• Entering into contractual data protection agreements with all receiving parties.
• Transferring data only to third parties in jurisdictions that maintain adequate data protection standards.
• Implementing technical security measures, including encryption, for all cross-border data transfers.

By using the toto313 Platform and accepting this Privacy Policy, you acknowledge and consent to the transfer of your personal data as described in this section, subject to the safeguards outlined above.

toto313 reserves the right to review and update this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. The revised Policy will be posted on this page with an updated "Last Updated" date at the top of the document.

Where amendments are material — for example, changes that significantly affect how we use your personal data or the rights available to you — toto313 will make reasonable efforts to notify affected Members via email or prominent in-Platform notification at least 14 days before the changes take effect.

Your continued use of the toto313 Platform following the posting of an updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree to the amended Policy, you must cease using the Platform and request account closure.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by toto313, please contact our customer support and data privacy team using the details below. We are committed to resolving all privacy enquiries promptly and transparently.

When submitting a data access, rectification, or erasure request, please include your registered Member ID or email address, a description of your request, and a copy of a valid identity document to enable us to verify your identity before processing the request. toto313 will not process data subject requests that cannot be verified.