This Privacy Policy describes how toto88 collects, processes, stores, and protects the personal data of players using our online casino and sports betting platform at toto88.casa. We are committed to handling your data with transparency, security, and respect for your rights under applicable data protection principles.
These cards summarise our core privacy commitments. The full legal detail is contained in the policy sections below.
toto88 only collects personal data that is strictly necessary for the operation of your account, identity verification, payment processing, responsible gambling compliance, and customer support. We do not collect data for purposes beyond those stated in this policy.
All personal data transmitted between your device and toto88's servers is encrypted using industry-standard 256-bit SSL/TLS protocols. Stored data is subject to access controls, encryption at rest, and regular security audits conducted by qualified personnel.
toto88 does not sell, rent, or trade your personal data to any third party for marketing purposes. Any data sharing with third-party service providers is governed by strict data processing agreements and is limited to what is operationally necessary.
All payment transactions at toto88 — whether via Maybank, Touch 'n Go eWallet, CIMB, DuitNow, FPX, or cryptocurrency — are processed through PCI-DSS compliant payment processors. toto88 does not store full card numbers or full bank account details on its own servers.
This Privacy Policy is written in plain, accessible English for our Malaysian players. We do not use deliberately obscure language or bury important data practices in footnotes. If you have questions about how your data is used, our support team can explain in English, Bahasa Melayu, or Mandarin.
You have the right to access, correct, export, and delete your personal data held by toto88. Requests are processed within a reasonable timeframe, typically 14 business days for standard requests. See Section 8 below for the full list of your data rights and how to exercise them.
This Privacy Policy ("Policy") is issued by toto88 ("toto88", "we", "us", "our"), the operator of the online casino and sports betting platform accessible at toto88.casa ("Platform"). This Policy explains how we collect, use, store, share, and protect the personal data of individuals ("Players", "Users", "you") who register for or use the toto88 Platform.
By registering an account, accessing the toto88 Platform, or otherwise using any of our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with any aspect of this Policy, you must not use the toto88 Platform.
This Policy should be read in conjunction with our Terms and Conditions, which govern your use of the toto88 Platform. Both documents form part of the binding agreement between you and toto88.
toto88 is committed to protecting the personal data of all players across Malaysia — including those based in Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam, and all other locations. We process personal data with the principle of minimal collection: we take only what we genuinely need to operate your account.
The following terms, when used in this Privacy Policy, shall have the meanings ascribed to them below:
toto88 collects Personal Data across the following categories, depending on the nature of your interaction with the Platform:
| Category | Data Collected | When Collected |
|---|---|---|
| Identity Data | Full name, date of birth, gender, nationality, government-issued ID number (e.g., MyKad number) | Registration & KYC verification |
| Contact Data | Email address, mobile phone number, residential address (city and state at minimum) | Registration & account updates |
| Financial Data | Transaction records (deposits and withdrawals), payment method type (e.g., TNG eWallet, Maybank), transaction amounts in MYR | Each deposit or withdrawal transaction |
| Usage Data | IP address, device type, operating system, browser type, pages visited, session duration, game history, betting history | Every Platform session |
| Communication Data | Records of live chat transcripts, support email correspondence, and any complaints or feedback submitted to toto88 | When you contact customer support |
| KYC Documentation | Copies of identity documents (MyKad, passport), proof of address, and where required, source-of-funds documentation | KYC verification requests |
toto88 does not collect or store complete bank account numbers, full credit or debit card numbers, or full CVV codes. Payment instrument details are handled exclusively by our PCI-DSS compliant payment processor partners. toto88 only retains a masked reference (e.g., last four digits) and the payment method category for transaction records.
toto88 uses the Personal Data collected from Players for the following purposes:
toto88 does not use your Personal Data for automated individual decision-making that produces legal or similarly significant effects without human review. Responsible gambling flags and fraud risk scores are reviewed by qualified personnel before any account restriction is applied.
toto88 processes Personal Data on the following legal grounds, each applicable to specific processing activities:
toto88 does not sell, rent, or trade your Personal Data to third parties for marketing or commercial profiling purposes under any circumstances. Personal Data may be shared with the following categories of recipients, strictly on a need-to-know and purpose-limited basis:
All third-party Data Processors that handle toto88 Player data are required to execute a data processing agreement confirming compliance with applicable data protection standards, restricting use of Player data to the stated purpose, and obligating them to implement appropriate technical and organisational security measures.
toto88 retains Personal Data for no longer than is necessary for the purposes for which it was collected, subject to the following retention schedules:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Identity Data | Duration of account + 5 years post-closure | Legal obligation (AML compliance) |
| Transaction Records | 7 years from transaction date | Legal obligation (financial record-keeping) |
| KYC Documentation | Duration of account + 5 years post-closure | Legal obligation (AML / KYC requirements) |
| Customer Support Records | 3 years from last interaction | Legitimate interests (dispute resolution) |
| Usage & Session Data | 12 months on a rolling basis | Legitimate interests (fraud prevention, analytics) |
| Marketing Consent Records | Until consent withdrawn + 2 years | Consent (evidence of lawful processing) |
Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that renders individual re-identification impossible. Retained anonymised or aggregated data may be used for statistical and analytical purposes without limitation.
As a Player and data subject, you have the following rights in relation to your Personal Data held by toto88. To exercise any of these rights, please contact our Data Protection team at [email protected] with the subject line "Data Rights Request".
You have the right to request a copy of the Personal Data toto88 holds about you, along with information about how it is being processed. We will respond to access requests within 14 business days of receipt and identity verification.
You have the right to request correction of any inaccurate or incomplete Personal Data held about you. Account profile updates for fields such as residential address and contact number can be made directly by contacting customer support.
You have the right to request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies. Note that erasure may not be possible where toto88 is required to retain data to fulfil legal obligations (e.g., AML record-keeping for 5 years post-account closure).
You have the right to receive a structured, commonly used, machine-readable copy of the Personal Data you have provided to toto88, for transfer to another service provider. This right applies to data processed on the basis of consent or contractual necessity.
You have the right to request that toto88 restrict the processing of your Personal Data in certain circumstances — for example, while the accuracy of data is contested, or where you have objected to processing pending verification of toto88's legitimate interests.
You have the right to object to processing based on legitimate interests, including profiling for responsible gambling risk assessment purposes. toto88 will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
Where processing is based on your consent (such as receiving promotional communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. To unsubscribe from marketing communications, contact [email protected] or use any unsubscribe mechanism in a marketing email.
toto88 uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are in use:
You may manage cookie preferences through your browser settings. Note that disabling Strictly Necessary cookies will prevent you from logging in and using the toto88 Platform. Disabling other cookie categories may reduce the quality and personalisation of your experience but will not prevent basic access to the Platform.
toto88 does not use third-party advertising or behavioural targeting cookies. We do not share cookie-derived Player behaviour data with any advertising network or social media platform for the purpose of targeting advertising at toto88 Players.
toto88 implements a multi-layered approach to data security, including the following technical and organisational measures:
While toto88 takes all reasonable and practicable steps to protect your Personal Data, no online transmission or electronic storage system is entirely without risk. We encourage Players to use strong, unique passwords and to enable 2FA to protect their accounts.
The toto88 Platform may integrate with or reference third-party services in the course of providing its features — for example, payment gateways for processing transactions via Touch 'n Go eWallet, Boost, Maybank, CIMB, Public Bank, GrabPay, DuitNow, or FPX. These third-party services operate under their own privacy policies, which toto88 does not control.
When you initiate a payment through a third-party gateway, you will be subject to that provider's terms of service and privacy policy in addition to toto88's. toto88 recommends that Players review the privacy practices of any third-party payment provider before completing a transaction.
toto88 is not responsible for the privacy practices, security standards, or content of third-party services. The fact that toto88 uses or references a third-party service does not constitute an endorsement of that service's privacy or security practices.
toto88 is strictly a 21+ platform. We do not knowingly collect or process Personal Data from individuals under the age of 21. Age verification is conducted at the point of registration and may be repeated at any time during a Player's account lifecycle.
If toto88 discovers or has reason to believe that Personal Data has been collected from an individual under the age of 21, we will immediately suspend the relevant account, delete all associated Personal Data to the extent not required for legal record-keeping purposes, and return any deposits made to the account.
If you are a parent or guardian and believe that a minor in your care has registered an account at toto88, please contact our customer support team immediately at [email protected]. We treat all such reports with the highest priority.
toto88 reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Any amendments will be published on this page with an updated "Last Updated" date.
Where a change materially affects how we process your Personal Data, toto88 will make reasonable efforts to notify you via your registered email address or through a notice displayed on the toto88 Platform prior to the change taking effect.
Your continued use of the toto88 Platform after the effective date of any amendment constitutes your acknowledgement of and agreement to the revised Privacy Policy. We recommend reviewing this page periodically to remain informed of how toto88 protects your data.
If you have questions, concerns, or requests relating to this Privacy Policy, or if you wish to exercise any of your data rights as described in Section 8, please contact toto88 through the following channels. All privacy-related correspondence is handled by our customer support team with escalation to our data protection function where required.
toto88 is built on a foundation of transparency and player trust. Your personal data is collected only for what we need, protected with industry-standard encryption, and never sold. Explore Malaysia's most trusted online casino and sportsbook with confidence. For players aged 21 and above only.