TotoWin Privacy Policy – Data Protection & Malaysian User Privacy

1 Introduction

TotoWin ("we", "company" or "Platform") is committed to protecting the privacy of all users who use our services on the totowin.vu website and related mobile applications. This Privacy Policy explains how we collect, use, store, protect and disclose your personal information.

We adhere to internationally recognised data protection principles and continually strive to ensure your data is handled in a transparent, fair and secure manner. This Policy applies to all users accessing the totowin platform regardless of the device or access method used.

By registering an account at TotoWin or using any of our services, you agree to the collection and use of your information as described in this Privacy Policy. Please read this document carefully and contact us if you have any questions or concerns.

2 Information We Collect

TotoWin collects two main categories of information — information you provide directly and information collected automatically when you use the platform.

2.1 Information You Provide Directly

• Registration information: Full name, date of birth, email address, phone number and password.
• Identity verification information (KYC): A copy of your identity card (MyKad) or passport, proof of address such as a bank statement or utility bill, and a selfie photo if required.
• Financial information: Bank account number, account holder name and e-wallet details for deposit and withdrawal purposes.
• Communications: Any messages, complaints or enquiries you send to our support team.

2.2 Information Collected Automatically

• Technical data: IP address, browser type, operating system, screen resolution, and device used.
• Usage data: Pages visited, time spent on the platform, games played and betting history.
• Transaction data: Records of all deposits, withdrawals and wagering activity in your account.
• Location data: General location based on IP address for geographic compliance and security purposes.

3 How We Use Your Data

TotoWin uses the information collected for the following purposes only:

• Account management: Creating, verifying and maintaining your account including all associated transactions.
• Transaction processing: Processing deposits, withdrawals and all financial activity in your account securely and promptly.
• Legal compliance: Meeting anti-money laundering (AML) requirements, verifying user age and complying with relevant regulatory directives.
• Platform security: Detecting and preventing fraud, unauthorised access and suspicious activity in your account.
• Customer support: Answering enquiries, resolving complaints and providing the technical assistance you need.
• Service improvement: Analysing usage patterns to improve the interface, performance and features of the totowin platform.
• Marketing communications: Sending information about promotions and special offers — you may unsubscribe at any time via your account settings.
• Responsible gaming: Monitoring gaming patterns to detect signs of excessive wagering and offering appropriate assistance.

4 Sharing Information with Third Parties

TotoWin not sell your personal information to any third party for marketing purposes. We only share information in the following limited circumstances:

• Payment service providers: Transaction information is shared with registered and licensed payment processors (DuitNow, FPX, e-wallets) to facilitate the processing of deposits and withdrawals.
• Game providers: Minimum technical data required to allow third-party game providers to ensure games function correctly within the TotoWin platform.
• Regulatory body: Information required by applicable law or regulatory bodies, including anti-money laundering agencies.
• Cybersecurity firm: Technical data required for regular security audits to verify the protection of TotoWin's systems.
• Legal process: Information required through a court order or valid legal process.

All third parties we work with are bound by strict data protection agreements and are not permitted to use your information for any purpose other than what is specified in those agreements.

5 Data Security

TotoWin employs strict technical and organisational security measures to protect your personal data from unauthorised access, loss, destruction or accidental disclosure.

• 256-bit SSL Encryption: All communications between your browser and totowin servers are protected with industry-standard SSL encryption.
• Database encryption: Sensitive data including passwords and financial information is stored in encrypted form in our database.
• Network segregation: Servers storing sensitive data are isolated from the public network with additional security layers.
• 24/7 Monitoring: An automated monitoring system operates around the clock to detect suspicious activity or unauthorised access attempts.
• Regular security audits: Penetration testing and security audits are conducted by independent firms on a regular basis to identify and address any vulnerabilities.
• Internal access controls: Only authorised totowin staff with legitimate job requirements may access user data, with all access logged and monitored.

6 Cookies & Tracking Technologies

TotoWin uses cookies and similar tracking technologies to enhance the user experience, analyse platform performance and enable certain features to function properly.

Types of Cookies We Use:

• Essential Cookies: Required for the platform to function correctly — including login sessions, language preferences, and security. Cannot be disabled.
• Performance Cookies: Collecting anonymised data on how users interact with the platform to help us improve the overall experience.
• Functional Cookies: Storing user preferences such as display layout and personal settings for convenience on future visits.
• Analytics Cookies: Helping us understand aggregate usage patterns to make better-informed platform improvement decisions.

You can manage cookies through your browser settings. However, disabling essential cookies may affect the functionality of the TotoWin platform.

7 Data Storage & Deletion

TotoWin only retains your personal data for as long as necessary to fulfil the purpose of collection or to comply with applicable legal requirements. Retention periods vary by data type as specified in the table in section 2.

When data is no longer needed, TotoWin will securely delete or destroy it using industry-recognised methods, ensuring it cannot be recovered or accessed again.

If you voluntarily close your totowin account, we will delete your personal data within a reasonable timeframe, except for data required by law to be retained for a longer period (such as financial transaction records required by Malaysia's AML laws).

8 Your Rights as a User

As a totowin user, you have the following rights regarding your personal data:

• Right of Access: Requesting a copy of the personal data we hold about you.
• Right to Rectification: Requesting correction of any inaccurate or outdated information.
• Right to Erasure: Requesting deletion of your personal data under certain circumstances permitted by law.
• Right to Object: Objecting to the processing of your data for direct marketing purposes.
• Right to Data Portability: Requesting your data in a machine-readable format for transfer to another service.
• Right to Withdraw Consent: Withdrawing consent for data processing where we rely on your consent as the legal basis.

To exercise any of the above rights, please contact the totowin support team via live chat or email. We will process your request within 30 working days. Some requests may require additional identity verification to ensure the security of your account.

9 Children's Privacy

TotoWin Platform not directed at individuals under the age of 18. We do not intentionally collect any personal information from children or individuals under the age of 18.

If we find that personal data has been collected from underage individuals without proper age verification, we will take immediate steps to delete that data and close the relevant account.

10 Privacy Policy Amendments

TotoWin reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, legal requirements or new platform features.

When a material change occurs, we will:

• Updating the "Last Updated" date at the top of this page.
• Displaying in-platform notifications during your login session.
• Sending an email to your registered address for significant changes.

We encourage you to review this page periodically. Continued use of the totowin platform after any amendments constitutes acceptance of the revised policy.

11 Contact Us for Privacy Inquiries

If you have any questions, concerns or requests regarding this Privacy Policy or how we handle your personal data, please contact the totowin Data Protection Officer through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week via the chat icon on the platform.
• Privacy Email: [email protected]
• General Support Email: [email protected]