Privacy Policy

toto399 ("we", "us", "our", or "the Platform") operates the online sports betting and live casino platform accessible at toto399.casa. As a platform serving players across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond — we recognise our obligation to handle personal data responsibly, securely, and transparently.

This Privacy Policy ("Policy") describes the categories of personal data we collect from users ("Players", "you", "your"), the purposes for which that data is processed, the legal bases upon which processing is conducted, and the rights available to you in respect of your personal data.

By registering an account on toto399, accessing or using any portion of the Platform, or interacting with toto399's customer support channels, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, you must not use the toto399 Platform.

For the purposes of this Policy, the following terms shall be construed as defined below:

• "Personal Data" — any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Processing" — any operation performed on personal data, whether or not by automated means, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the entity that determines the purposes and means of processing personal data. For data collected through the toto399 Platform, the data controller is the operating entity behind toto399.casa.
• "Data Processor" — a third party that processes personal data on behalf of the Data Controller, pursuant to a written agreement.
• "Consent" — freely given, specific, informed, and unambiguous agreement by a data subject to the processing of their personal data for one or more specific purposes.
• "KYC" — Know Your Customer. The identity and age verification process conducted prior to processing withdrawals and in fulfilment of applicable compliance obligations.
• "Cookies" — small text files placed on a user's device by a website to store information about the user's preferences, session identifiers, or browsing behaviour.
• "Sensitive Personal Data" — categories of personal data that warrant heightened protection, including but not limited to financial account information, identity document data, and information relating to health or problem gambling indicators.

toto399 collects only the personal data that is necessary to provide our services, fulfil regulatory obligations, and maintain platform security. The categories of data we collect are described in the table below.

toto399 does not knowingly collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric data used for identification, or health data, except to the extent that health-related information is voluntarily provided by a Player in the context of a responsible gambling request (e.g., a self-exclusion request citing gambling-related harm).

toto399 collects personal data through the following means:

4.1 Direct Collection

Data you provide voluntarily when creating a toto399 account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or setting responsible gambling tools.

4.2 Automated Collection

Technical and usage data collected automatically when you access or use the Platform, including through cookies, server logs, and similar technologies. This data is collected without any action on your part and is inherent to your use of the website. See Section 10 for further details on our cookie usage.

4.3 Third-Party Sources

Where permitted by applicable law, toto399 may receive personal data from third parties, including:

• Identity verification service providers engaged to assist with KYC compliance;
• Payment processors and financial institutions processing your deposits and withdrawals, including operators of DuitNow, FPX, Touch 'n Go eWallet, Boost, Maybank, CIMB, and Public Bank;
• Fraud detection and anti-money laundering screening providers;
• Publicly available registers used for sanctions and politically exposed persons (PEP) screening.

toto399 processes personal data on one or more of the following legal bases, depending on the purpose of the processing:

• Contractual Necessity: Processing required to perform our contractual obligations to you as a registered toto399 player, including account management, payment processing, and delivery of gaming services.
• Legal Obligation: Processing required to comply with applicable anti-money laundering (AML), counter-terrorism financing (CTF), and KYC regulations, as well as any lawful orders from competent authorities.
• Legitimate Interests: Processing conducted for toto399's legitimate business interests, where those interests are not overridden by your privacy rights. This includes fraud prevention, platform security, and responsible gambling monitoring.
• Consent: Processing based on your freely given, specific, and informed consent, such as for certain marketing communications. You may withdraw consent at any time by contacting our support team, though withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.
• Vital Interests: In exceptional circumstances, processing may be necessary to protect your vital interests or those of another person, such as in response to a responsible gambling or safeguarding concern.

toto399 processes your personal data for the following specific purposes:

1. Account Registration & Management: To create and administer your toto399 account, authenticate your identity at login, and maintain your account preferences and history.
2. KYC & Age Verification: To verify that you are at least 21 years of age and to confirm your identity in accordance with our regulatory obligations. This is mandatory before any withdrawal is processed.
3. Payment Processing: To facilitate deposits in MYR via supported Malaysian payment methods and to process withdrawal requests to your registered payment instrument.
4. Gaming Services Delivery: To provide access to toto399's sports betting, live casino, slots, and instant game services, including the calculation and settlement of bets and the crediting of winnings.
5. Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, unauthorised account access, collusion, bonus abuse, and money laundering.
6. Responsible Gambling: To monitor your gaming activity for indicators of problem gambling, to administer any responsible gambling tools you activate (deposit limits, self-exclusion, etc.), and to respond to responsible gambling requests in a timely manner.
7. Customer Support: To respond to your enquiries, resolve complaints, and maintain a record of your support interactions for quality assurance purposes.
8. Legal Compliance: To fulfil obligations under applicable international licensing, AML, CTF, and data protection requirements, and to respond to lawful requests from competent authorities.
9. Platform Improvement: To analyse usage patterns and technical performance data to improve the functionality, stability, and user experience of the toto399 Platform.
10. Marketing Communications: Where you have provided consent, to send you information about toto399 promotions, bonus offers, and relevant updates. You may opt out of marketing communications at any time.

toto399 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients, strictly for the purposes described in this Policy:

• Identity Verification Providers: Third-party KYC and document verification services engaged to assist with age and identity verification during the account registration and withdrawal processes.
• Payment Processors: Malaysian payment service operators including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and partner banking institutions (Maybank, CIMB, Public Bank, Hong Leong Bank) that facilitate your financial transactions on the Platform.
• Fraud & AML Service Providers: Specialist providers engaged to perform sanctions screening, politically exposed persons (PEP) checks, and real-time transaction fraud analysis.
• Game Studio Partners: Licensed international game studios whose products are integrated into the toto399 Platform may receive anonymised or pseudonymised gameplay data for RNG auditing and certification purposes. No directly identifiable player data is shared with game studios for commercial use.
• Technical Infrastructure Providers: Cloud hosting, content delivery network (CDN), and database service providers who process data on our behalf under strict data processing agreements.
• Legal & Regulatory Authorities: Where required by applicable law, court order, or regulatory directive, toto399 may disclose personal data to competent authorities. We will notify you of any such disclosure where we are legally permitted to do so.
• Professional Advisers: Lawyers, auditors, and compliance consultants engaged in connection with toto399's legal and regulatory obligations, each subject to professional confidentiality duties.

As toto399 operates under an international online gaming licence and engages service providers in multiple jurisdictions, your personal data may be transferred to and processed in countries outside Malaysia. Such transfers may occur to jurisdictions that do not have data protection laws equivalent to those in your home jurisdiction.

Where such transfers take place, toto399 ensures that appropriate safeguards are in place, which may include:

• Entering into standard contractual clauses with the receiving entity;
• Ensuring the recipient is subject to a binding corporate data protection programme;
• Confirming that the destination jurisdiction has been assessed as providing an adequate level of data protection by a recognised authority.

By using the toto399 Platform, you acknowledge and consent to the international transfer of your personal data in accordance with the safeguards described above. If you have questions about the specific safeguards applicable to a particular transfer, please contact our support team.

toto399 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. The following general retention principles apply:

• Active Account Data: Retained for the duration of your account's active status plus a minimum period following account closure to fulfil regulatory and dispute resolution obligations.
• KYC & Identity Verification Records: Retained for a minimum of five (5) years following account closure, in accordance with standard AML and financial services record-keeping requirements.
• Transaction & Betting History: Retained for a minimum of five (5) years following the relevant transaction or bet, for the purposes of dispute resolution, financial auditing, and regulatory compliance.
• Customer Support Communications: Retained for a period of three (3) years following the last support interaction, for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Retained until consent is withdrawn and for a reasonable period thereafter to demonstrate compliance with consent obligations.
• Technical Logs: Server logs and access logs are retained for a maximum of twelve (12) months, after which they are securely deleted unless there is an active security investigation requiring their preservation.

Upon expiry of the relevant retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with a specific individual.

toto399 uses cookies and similar tracking technologies to operate the Platform, personalise your experience, maintain session security, and analyse platform performance. The categories of cookies we use are described below:

10.1 Strictly Necessary Cookies

These cookies are essential to the functioning of the toto399 Platform and cannot be disabled without materially affecting your ability to use it. They include session authentication tokens, security cookies, and load-balancing identifiers. No consent is required for strictly necessary cookies.

10.2 Functional Cookies

Functional cookies remember your preferences and settings (such as language preference and display options) to provide an enhanced and personalised experience across sessions. These cookies do not track your browsing activity on third-party websites.

10.3 Analytical Cookies

We use first-party analytical tools to understand how Players use the Platform — which pages are visited most, where players navigate from, and how long they spend on particular sections. This data is used solely to improve the Platform. Analytical cookies collect data in aggregate form and do not identify individual users.

10.4 Managing Cookies

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the toto399 Platform. Instructions for managing cookies in the most common browsers (Chrome, Firefox, Safari, Edge) are available through each browser's help documentation.

toto399 implements industry-standard technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser and the toto399 Platform is encrypted in transit using TLS 1.2 or higher. Our SSL certificate is validated and maintained continuously.
• Encryption at Rest: Sensitive personal data, including identity documents and financial information, is encrypted when stored on our servers using AES-256 or equivalent standards.
• Access Controls: Access to personal data within toto399's internal systems is restricted on a need-to-know basis, enforced through role-based access controls and multi-factor authentication for administrative access.
• Password Security: Account passwords are stored as salted cryptographic hashes. toto399 does not have access to your plaintext password at any point.
• Intrusion Detection: Our infrastructure is monitored continuously for unusual activity, attempted breaches, and anomalous access patterns by our security operations team.
• Data Minimisation: toto399 collects and retains only the personal data strictly necessary for the purposes described in this Policy.

Notwithstanding the above, no data transmission over the internet or method of electronic storage can be guaranteed to be 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, toto399 will notify affected Players in accordance with applicable notification obligations.

Subject to applicable law and any overriding legal obligations on toto399, you have the following rights in relation to your personal data:

• Right of Access: You have the right to request a copy of the personal data toto399 holds about you, together with information about how that data is being processed.
• Right to Rectification: You have the right to request that inaccurate or incomplete personal data held by toto399 be corrected without undue delay.
• Right to Erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn, or where processing is unlawful. This right is subject to toto399's legal obligation to retain certain data for regulatory compliance and dispute resolution purposes.
• Right to Restrict Processing: You have the right to request that toto399 restrict the processing of your personal data in certain circumstances, such as while the accuracy of data is contested or an objection is being considered.
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing conducted on the basis of legitimate interests, including for direct marketing purposes. We will cease marketing communications immediately upon receipt of a valid objection.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the rights described above, please contact toto399 via the live chat available on the Platform or by email at the address provided in Section 16. We will respond to all valid requests within thirty (30) days of receipt. Identity verification may be required before any request is actioned.

The toto399 Platform is strictly for use by persons aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. Registration by minors is prohibited, and toto399 implements age verification controls to prevent underage access.

If toto399 becomes aware that personal data has been collected from an individual under the age of 21 — whether through fraudulent registration or any other means — we will take immediate steps to close the associated account, delete or anonymise the collected data, and, where applicable, return any deposited funds in accordance with our Terms and Conditions and applicable legal requirements.

If you are a parent or guardian and believe your child has registered on the toto399 Platform, please contact us immediately via live chat or email so that we can investigate and take appropriate action without delay.

The toto399 Platform may contain references or connections to third-party services, including payment processors and game delivery partners. Once you access a third-party service — including when you initiate a payment through a provider such as Touch 'n Go eWallet, Boost, DuitNow, FPX, or your bank's online platform — that third party's own privacy policy governs the handling of your data.

toto399 does not control and is not responsible for the privacy practices of any third-party service provider. We recommend reviewing the privacy policies of any third-party services you use in connection with your toto399 account. toto399's responsibility for the privacy of your data extends only to data processed directly by toto399 and its contracted processors operating under data processing agreements with us.

toto399 reserves the right to update or amend this Privacy Policy at any time. Where a material change is made, we will provide notice to active Players via the Platform or via the email address registered to the affected account, at our discretion and to the extent required by applicable law.

The version of this Policy bearing the most recent "Last Reviewed" date displayed on this page constitutes the current operative version. We encourage you to review this Policy periodically. Your continued use of the toto399 Platform following the publication of an updated Policy constitutes your acceptance of the amended terms.

For any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data by toto399, please contact us through the following channels:

• Live Chat: Available 24/7 directly through the toto399 Platform. This is the fastest method for time-sensitive data requests or responsible gambling matters. Average first-response time is under two minutes during peak hours (8 AM – 2 AM MYT).
• Email (non-clickable, plain text): [email protected] — please include "Privacy Request" in the subject line for data-related enquiries to ensure routing to the appropriate team.

toto399 is committed to acknowledging all formal data-related requests within twenty-four (24) hours and to providing a substantive response within thirty (30) days. We may require identity verification before acting on any request that involves access to or modification of your personal data.

For information about responsible gambling tools, limits, and self-exclusion options, please refer to our Responsible Gambling page. For the contractual terms governing your use of the Platform, please see our Terms & Conditions.