toto8 Privacy Policy

1. Introduction

toto8 takes the privacy of its users seriously. As a licensed online gaming operator serving Malaysian players and the broader international market, toto8 is required by its licensing authority to implement and maintain robust data protection practices. This Policy explains those practices in plain, accessible language so that every toto8 user understands exactly how their personal data is handled from the moment they visit the Platform to the point at which their Account is closed and data retention obligations are fulfilled.

toto8 collects personal data only to the extent necessary to provide the gaming services described on the Platform, to comply with legal and licensing obligations — including anti-money-laundering (AML) requirements and responsible gaming mandates — and to improve the user experience for Malaysian players and our wider user base. We do not collect data for speculative future purposes or share it with parties who have no legitimate role in the operation of the toto8 Platform.

This Policy applies to all personal data collected through the toto8 website at toto8.bio, including data collected via account registration forms, deposit and withdrawal flows, KYC document submissions, live chat and email communications, and automated technical data collection such as server logs and cookies.

2. Data Controller

For the purposes of applicable data protection law, the data controller responsible for your personal data is toto8, operating the Platform at toto8.bio under international online gaming authority licensing.

Questions about this Policy or requests to exercise your data rights should be directed to the toto8 Data Protection contact channel, reachable via the support email address set out in Section 16 of this Policy.

3. Categories of Personal Data We Collect

toto8 collects the following categories of personal data from its users:

toto8 does not intentionally collect special categories of sensitive personal data (such as health data, biometric data beyond liveness check photographs, or political opinions) and does not request such information from users.

4. How We Collect Personal Data

toto8 collects personal data through the following channels:

• Directly from you: when you complete the account registration form, submit KYC documents, make a deposit or withdrawal request, contact live chat or email support, or update your account profile settings.
• Automatically: when you access or use the Platform, our servers automatically record technical data including your IP address, device identifiers, browser characteristics, pages visited, time spent on pages, and session information. This data is collected via server logs, cookies, and similar technologies as described in Section 11.
• From third parties: toto8 may receive identity verification data from licensed KYC service providers who cross-reference submitted documents against official databases as part of the age and identity verification process. toto8 may also receive fraud risk signals from payment processors in connection with deposit and withdrawal transactions.

5. Legal Bases for Processing Personal Data

toto8 processes your personal data on the following legal bases:

• Performance of a contract: Processing is necessary to provide you with the gaming services you have registered for, including account management, game access, payment processing, and customer support.
• Legal obligation: toto8 is required to process certain data to comply with licensing conditions, AML regulations, age verification mandates, and applicable financial regulations.
• Legitimate interests: toto8 processes technical and gaming activity data to maintain platform security, prevent fraud, detect and prevent problem gambling patterns, and improve the user experience — in each case where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Where required, toto8 will seek your explicit consent before processing data for purposes such as marketing communications. You may withdraw consent at any time through your Account settings or by contacting support.

6. How We Use Your Personal Data

toto8 uses collected personal data for the following purposes:

• To create, verify, and manage your toto8 Account;
• To process deposits, withdrawals, and other financial transactions;
• To verify your identity and age as required by our licensing obligations (mandatory KYC);
• To detect and prevent fraud, money laundering, and other financial crimes;
• To enforce our Terms & Conditions, including the single-account rule and prohibited conduct provisions;
• To provide and improve customer support services via live chat and email;
• To monitor gaming activity for responsible gaming purposes, including identifying patterns associated with problem gambling and offering or enforcing responsible gaming tools;
• To send you transactional communications (deposit confirmations, withdrawal notifications, account security alerts) — these are necessary communications not subject to marketing opt-out;
• To send you promotional communications about toto8 offers, bonuses, and new features — only where you have consented to receive such communications;
• To conduct internal analytics to understand how the Platform is used and to improve its functionality, security, and content for Malaysian and international users;
• To comply with requests from regulatory authorities, law enforcement agencies, or courts of competent jurisdiction.

7. Data Sharing & Third-Party Disclosure

toto8 does not sell or rent your personal data to third parties. Personal data is shared only in the circumstances described below, and only to the extent necessary for each stated purpose:

• Licensed payment processors (e-wallet providers, bank payment gateways, cryptocurrency processors) — to execute your deposit and withdrawal transactions. These processors are contractually bound to process data only for the purpose of completing your payment and are prohibited from using it for any other purpose.
• KYC and identity verification service providers — to verify your identity documents and confirm your age as required by our licensing authority. Verification providers are bound by strict data processing agreements.
• Game studios and software providers (including Evolution Gaming, Pragmatic Play, and others) — to deliver game content through the Platform. These providers may receive limited technical session data (such as a pseudonymous session token) necessary to render games but do not receive your full personal identity data.
• Regulatory and licensing authorities — as required by toto8's gaming licence and applicable law. toto8 cooperates fully with all legitimate regulatory requests.
• Law enforcement and legal authorities — where required by court order, subpoena, or equivalent legal process, or where toto8 reasonably believes disclosure is necessary to prevent crime, fraud, or harm to persons.
• Professional advisors — including lawyers, auditors, and compliance consultants who are contractually bound to maintain confidentiality.

In the event of a merger, acquisition, or sale of toto8 business assets, personal data may be transferred to the acquiring entity subject to equivalent privacy protections. Users will be notified of any such transfer that materially affects their data rights.

8. International Data Transfers

8.1 toto8 is an internationally operating platform. Your personal data may be transferred to, stored in, and processed in countries other than your country of residence — including countries in which our game providers, payment processors, or cloud infrastructure providers are located.

8.2 Where personal data is transferred outside the jurisdiction of origin, toto8 ensures that appropriate safeguards are in place, including data processing agreements incorporating standard contractual clauses or equivalent transfer mechanisms recognised under applicable data protection law.

8.3 By using the toto8 Platform, you acknowledge and consent to the transfer of your personal data internationally as described in this section, subject to the safeguards described herein.

9. Data Retention

toto8 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to applicable legal and regulatory retention requirements. The following retention principles apply:

• Active accounts: Personal data associated with an active toto8 Account is retained for the lifetime of the Account plus a post-closure period as required by licensing and AML regulations.
• Financial and KYC records: Transaction records and identity verification documents are retained for a minimum of five (5) years following Account closure, in accordance with standard AML and financial record-keeping requirements under our licensing obligations.
• Support communications: Live chat transcripts and email correspondence are retained for three (3) years from the date of the communication, unless retention is required for longer in connection with an ongoing dispute or legal matter.
• Technical/log data: Server logs, IP addresses, and session data are retained for up to twelve (12) months for security and fraud monitoring purposes.
• Marketing preferences: Consent records and opt-out records are retained for seven (7) years to demonstrate compliance with consent requirements.

Following the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

10. Security Measures

toto8 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• 256-bit SSL/TLS encryption applied to all data in transit between your device and toto8 servers;
• Encryption at rest for sensitive data categories including identity documents and payment details stored in toto8 databases;
• Access controls — personal data is accessible only to toto8 staff and authorised third parties who have a legitimate operational need, governed by role-based access permissions;
• Two-factor authentication enforced for all toto8 internal administrative systems;
• Regular security audits and penetration testing conducted by independent security specialists;
• Incident response procedures — in the event of a data breach that poses a risk to your rights and freedoms, toto8 will notify affected users and relevant authorities within the timeframes required by applicable law.

While toto8 takes all reasonable steps to protect your data, no internet transmission or electronic storage system is entirely secure. You are responsible for maintaining the security of your toto8 login credentials and for enabling two-factor authentication, which is strongly recommended for all accounts.

11. Cookies & Tracking Technologies

toto8 uses cookies and similar tracking technologies to maintain your session, remember your preferences, and collect analytics data that helps us improve the Platform. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function, including session management, login state, and security tokens. These cannot be disabled without breaking core Platform functionality.
• Functional cookies: Store your preferences (such as language settings and game lobby layout) to personalise your experience.
• Analytics cookies: Collect aggregated, anonymised data about how users navigate the Platform. This data is used solely to improve toto8's design and performance. No personally identifiable data is included in analytics reports.
• Marketing cookies: Only deployed with your explicit consent, as governed by your cookie consent preferences.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to toto8 and using most Platform features.

12. Your Data Protection Rights

Subject to applicable law and toto8's legitimate interests and legal obligations, you have the following rights in respect of your personal data:

• Right of Access: You may request a copy of the personal data toto8 holds about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes collected and no overriding legal obligation requires its retention.
• Right to Restriction: You may request that toto8 restricts processing of your data in certain circumstances, such as while a dispute about data accuracy is resolved.
• Right to Data Portability: You may request a machine-readable export of personal data you have provided to toto8, where processing is based on consent or contract.
• Right to Object: You may object to processing based on legitimate interests, including profiling for responsible gaming purposes, subject to toto8's overriding legitimate interests or legal obligations.
• Right to Withdraw Consent: Where processing is based on your consent (such as marketing communications), you may withdraw consent at any time through your Account settings or by contacting support. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, contact toto8 via the support email set out in Section 16. Requests will be acknowledged within 5 business days and processed within 30 calendar days. toto8 may request verification of your identity before processing a data rights request to prevent unauthorised access to another person's data.

13. Children & Minors

The toto8 Platform is strictly for adults aged 21 and above. toto8 does not knowingly collect personal data from persons under the age of 21. The mandatory KYC identity verification process is designed to prevent minors from accessing the Platform.

If toto8 becomes aware that personal data has been collected from a person under 21, the associated Account will be immediately closed, all funds will be dealt with in accordance with the Terms & Conditions, and the minor's personal data will be deleted to the extent not required to be retained for legal or regulatory purposes.

If you believe a minor has registered a toto8 Account, please contact support immediately via the channels in Section 16.

14. Third-Party Links

The toto8 Platform may contain links to third-party websites or services (for example, game provider product pages or payment processor portals). toto8 is not responsible for the privacy practices of third-party websites and this Policy does not apply to data you provide to, or that is collected by, those third parties. toto8 recommends reviewing the privacy policy of any third-party website you visit via a link from the toto8 Platform.

15. Updates to This Privacy Policy

toto8 may update this Privacy Policy from time to time to reflect changes in data processing practices, new legal or regulatory requirements, or improvements to the Platform. When material changes are made, a notice will be displayed on the Platform and, where reasonably practicable, registered users will be notified via the email address associated with their Account.

The "Last Updated" date at the top of this Policy indicates when the most recent revision was made. Continued use of the Platform following notification of a Policy update constitutes acceptance of the revised Policy. If you do not accept the updated Policy, you should cease using the Platform and may request closure of your Account.

16. Contact & Data Rights Requests

For questions about this Privacy Policy, to exercise your data protection rights, or to raise a data-related concern, you may contact toto8 through the following channels:

• Live Chat: Available 24/7 via toto8.bio — average response time under 2 minutes.
• Email: [email protected] — responses within 3 hours for non-urgent queries; data rights requests processed within 30 calendar days.

Please include your registered username, the nature of your request or query, and — for data rights requests — sufficient information to verify your identity. toto8 will handle all privacy-related communications with appropriate confidentiality.