This Privacy Policy explains how toto20 collects, uses, stores, shares, and protects the personal data of players and visitors to the toto20 platform. We are committed to handling your information responsibly and in compliance with applicable international data protection standards. Please read this document in full before registering an account or using our services.
Six key privacy principles that underpin how toto20 handles your personal data. The full binding policy follows below.
toto20 collects only the personal data that is strictly necessary to operate your account, process transactions, verify your identity, and comply with regulatory obligations. We do not collect data speculatively or for purposes that have not been disclosed to you in this Policy.
All data transmitted between your device and our platform is protected by 256-bit SSL/TLS encryption. Personal data at rest is stored in encrypted form on secured servers subject to strict access controls. Payment data is processed through PCI-DS compliant payment gateways.
toto20 does not sell, rent, or trade your personal data to third parties for marketing or commercial purposes. Data shared with third parties is limited to what is necessary for service delivery — such as payment processors, identity verification providers, and fraud prevention services.
You have the right to access, correct, and request deletion of your personal data at any time. You also have the right to object to certain processing activities and to request a portable copy of your data. These rights can be exercised by contacting our support team.
We use cookies and similar tracking technologies to maintain session state, analyse platform performance, and improve your user experience. You can manage cookie preferences through your browser settings. Non-essential cookies are not deployed without your awareness.
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulatory obligations. When data is no longer required, it is securely deleted or anonymised in accordance with our data retention schedule.
This Privacy Policy (hereinafter "Policy") issued by toto20 (hereinafter "toto20", "we", "us", or "the Platform"), the operator of the online casino and sports betting platform accessible at https://toto20.casa. It describes how toto20 collects, uses, stores, discloses, and otherwise processes the personal data of individuals who register an account, visit the Platform, or otherwise interact with our services.
toto20 is committed to protecting the privacy and personal data of its members, including Malaysian players and all other eligible users. This Policy has been prepared with reference to internationally recognised data protection principles, including those established under frameworks applicable to our operating jurisdiction.
By registering an account, making a deposit, or otherwise using theoto20 Platform, you acknowledge that you have read, understood, and agreed to the data practices described in this Policy. If you do not agree with any aspect of this Policy, you should discontinue use of the Platform and contact customer support to close your account.
The following definitions apply throughout this Policy:
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person, including name, email address, date of birth, payment details, IP address, and device identifiers. |
| "Processing" | Any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, or deletion. |
| "Data Controller" | The entity that determines the purposes and means of processing Personal Data — in this context, toto20. |
| "Data Processor" | A third party that processes Personal Data on behalf of the Data Controller — for example, a payment gateway or identity verification provider. |
| "Consent" | A freely given, specific, informed, and unambiguous indication of agreement to the processing of Personal Data for a stated purpose. |
| "KYC" | Know Your Customer — the identity verification process required for account funding and withdrawal. |
| "Cookie" | A small text file placed on your device by the Platform to store session information, preferences, and analytics data. |
When you register an account, complete KYC verification, contact customer support, or interact with toto20's services, you may provide the following categories of personal data:
When you access the toto20 Platform, certain technical data is collected automatically:
toto20 may receive personal data about you from third-party sources in the following circumstances:
toto20 processes your personal data one or more of the following legal bases, depending on the specific processing activity:
| Legal Basis | Examples of Processing Activities |
|---|---|
| Contractual Necessity | Account registration, processing deposits and withdrawals, settling bets, applying bonus credits, and providing customer support. |
| Legal Obligation | KYC/AML compliance, age verification, fraud prevention, responding to regulatory or law enforcement requests, and record-keeping obligations under applicable laws. |
| Legitimate Interests | Platform security, fraud detection, improving service quality through usage analytics, and communicating service-related updates to existing members. |
| Consent | Sending marketing communications and promotional offers where you have opted in. You may withdraw consent at any time without affecting the lawfulness of prior processing. |
toto20 uses the personal data it collects for the following purposes:
toto20 does not sell your personal data. We share personal data with third parties only in the following circumstances and only to the extent necessary:
We engage third-party service providers to assist with specific functions, including:
All service providers are bound by contractual data processing agreements that prohibit them from using your personal data for any purpose other than the specific service they provide toto20.
toto20 may disclose personal data to regulatory authorities, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory instruction. Where permitted, we will inform you of any such disclosure.
In the event of a merger, acquisition, restructuring, or sale of all or part of the toto20 business, your personal data may be transferred to the acquiring entity as part of the transaction. You will be notified of any such transfer and the privacy terms applicable to your data under the new entity.
As an international platform, toto20 operates infrastructure across multiple jurisdictions. Your personal data may be processed in countries other than Malaysia, including in the jurisdiction where toto20 holds its operating licence.
Where personal data is transferred internationally, toto20 implements appropriate safeguards to ensure that your data receives a standard of protection equivalent to that provided within the originating jurisdiction. These safeguards may include:
toto20 retains personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable legal, regulatory, or contractual obligations. The following indicative retention periods apply:
| Data Category | Retention Period |
|---|---|
| Account & Identity Data | Duration of account plus 5 years after closure (AML obligation). |
| KYC Documents | Duration of account plus 5 years after closure, or as mandated by applicable regulatory requirements. |
| Transaction Records | 7 years from the date of each transaction, in compliance with financial record-keeping requirements. |
| Customer Support Communications | 3 years from the date of the last communication. |
| Usage & Analytics Data | Up to 24 months, after which it is anonymised or deleted. |
| Marketing Consent Records | Until consent is withdrawn, plus 12 months for evidence purposes. |
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised using methods appropriate to the sensitivity of the data.
toto20 implements a layered security framework to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Key measures include:
While toto20 employs rigorous security measures, no data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. You are encouraged to protect your account by using a strong, unique password and enabling two-factor authentication where available.
Cookies are small text files stored on your device by the Platform when you visit. They allow the Platform to recognise your device across sessions and to store certain preferences and session state information.
| Cookie Type | Purpose |
|---|---|
| Strictly Necessary | Required for the Platform to function. These include session authentication cookies, security tokens, and load balancing cookies. These cannot be disabled without disrupting platform functionality. |
| Performance / Analytics | Used to collect anonymised data about how users navigate the Platform — pages visited, time spent, error rates — to improve platform performance and user experience. |
| Functional | Store user preferences such as language settings, display preferences, and previously used payment methods to provide a more personalised experience. |
| Responsible Gambling | Track session duration and gaming activity to power session time reminders and responsible gambling monitoring tools. |
You can manage and delete cookies through your browser settings. Most modern browsers allow you to block all cookies, accept only first-party cookies, or receive a notification before a cookie is placed. Please note that disabling strictly necessary cookies will prevent you from logging in to your toto20 account or using core platform features.
Subject to applicable law and certain exceptions, you have the following rights with respect to your personal data held by toto20:
You may request a copy of the personal data toto20 holds about you, along with information about how it is being used.
If any personal data we hold about you is inaccurate or incomplete, you may request that it be corrected or updated.
You may request deletion of your personal data where it is no longer necessary, consent has been withdrawn, or processing was unlawful — subject to regulatory retention requirements.
You may request that toto20 limit the processing of your data in certain circumstances, such as while an accuracy dispute is resolved.
You may request a structured, machine-readable copy of personal data provided by you, suitable for transfer to another service provider.
You may object to processing based on legitimate interests or for direct marketing purposes. Objections to marketing communications will be actioned promptly.
To exercise any of the above rights, please contact our support team via live chat or email at [email protected]. We will respond to all valid rights requests within 30 days. In some circumstances we may need to verify your identity before processing a request.
toto20 strictly prohibits the use of its Platform by individuals under the age of 21. We do not knowingly collect personal data from persons under this age. All accounts are subject to age verification as part of the KYC process.
If toto20 becomes aware that personal data has been collected from an individual under the age of 21, that account will be immediately suspended, any balance returned, and the personal data deleted in accordance with our retention policy — except where retention is required by law for the purposes of reporting the matter.
With your consent, toto20 may send you promotional communications about bonuses, new games, sports betting markets (such as Liga Super Malaysia and EPL match specials), seasonal promotions, and VIP programme updates via email or push notification.
You may opt out of marketing communications at any time by:
Opting out of marketing communications does not affect your receipt of transactional communications such as deposit confirmations, withdrawal notifications, or security alerts — these are sent as necessary part of account management and cannot be opted out of while your account is active.
The toto20 Platform may integrate with third-party services whose privacy practices are governed by their own privacy policies rather than this Policy. These may include:
toto20 is not responsible for the privacy practices of third-party service providers. We encourage you to review the privacy policies of any third-party services you interact with, particularly payment services where you provide financial credentials directly to those providers.
toto20 reserves the right to update or amend this Privacy Policy at any time. Material changes — those that significantly affect how your data is processed or your rights in relation to that data — will be communicated via a prominent notice on the Platform and, where possible, by email to your registered address, at least 14 days before the change takes effect.
The current version of this Policy, including its effective date, is always accessible at toto20.casa/privacy-policy. Continued use of the Platform after the effective date of any amendment constitutes your acknowledgement of the updated Policy.
If you have questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact toto20 through the following channels:
Understand your full rights and obligations as a toto20 member by reviewing our other policy documents and support resources.
Review the full Terms & Conditions governing account registration, deposits, withdrawals, bonuses, and wagering on toto20.
Read T&CLearn about our responsible gambling tools — deposit limits, self-exclusion, session reminders — and external support resources.21+ only.
View ResourcesReturn to the toto20 homepage to explore our full game catalogue, current promotions, and MYR payment options for Malaysian players.
Go to Homepage⚠️ For players aged 21 and above only. Gambling can be addictive — please play responsibly.