Privacy Policy

This Privacy Policy ("Policy") describes how Totonito ("we", "us", "our"), the operator of the online gambling and sports betting platform accessible at totonito.cam ("the Platform"), collects, processes, stores, shares, and protects the personal data of individuals ("you", "your", "the Player") who register for, access, or use our services.

Totonito is committed to respecting your privacy and handling your personal information responsibly. This Policy has been drafted in accordance with applicable data protection legislation and the principles of transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

By creating an account on the Platform, making a deposit, or otherwise accessing our services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree to this Policy, please do not use the Platform.

This Policy was last reviewed and updated on 1 January 2026. Where prior versions of this Policy exist, this version supersedes all previous versions in full.

For the purposes of this Policy, the following definitions shall apply:

• "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or one or more factors specific to that person.
• "Processing" means any operation or set of operations performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, combination, restriction, erasure, or destruction.
• "Data Controller" means Totonito, the entity that determines the purposes and means of Processing Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of Totonito under a contractual arrangement.
• "KYC Data" means identity verification documentation submitted by a Player as part of the Know Your Customer verification process, including but not limited to identity cards, passports, and proof of address documents.
• "Cookies" means small text files placed on your device by the Platform to store session information, preferences, and analytics data.
• "MYR" means Malaysian Ringgit, the currency in which all financial transactions on the Platform are conducted.

Totonito collects the following categories of Personal Data:

Totonito does not knowingly collect special categories of sensitive Personal Data (such as racial or ethnic origin, religious beliefs, health data, or biometric data) unless strictly required for regulatory compliance purposes, in which case explicit consent will be sought.

We collect Personal Data through the following means:

4.1 Direct Collection

Data you provide directly when you register an account, complete the KYC verification process, make a deposit or withdrawal request, contact our support team, or update your account profile. This includes all information entered into forms on the Platform.

4.2 Automated Collection

Data collected automatically as you use the Platform, including Technical Data and Usage Data gathered via cookies, web beacons, server logs, and similar tracking technologies. This data is collected to maintain platform security, detect fraudulent activity, and improve the user experience.

4.3 Third-Party Sources

In limited circumstances, Totonito may receive Personal Data from third-party identity verification providers, payment processors, fraud prevention services, and publicly available sources (such as sanctions lists and Politically Exposed Persons databases), to fulfil our AML and compliance obligations. All third-party data sources are vetted for legitimacy prior to use.

Totonito processes your Personal Data on the following legal bases:

• Contractual Necessity: Processing is required to perform our contract with you — i.e., to provide the gambling and betting services you have registered for, process your deposits and withdrawals, and manage your account.
• Legal Obligation: Processing is necessary to comply with applicable laws and regulations, including anti-money laundering (AML) legislation, age verification requirements, financial reporting obligations, and any lawful requests from regulatory or law enforcement authorities.
• Legitimate Interests: Processing is conducted in pursuit of Totonito's legitimate interests, including platform security, fraud detection, service improvement, and responsible gambling monitoring — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Where processing is based on your consent (for example, for optional marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Totonito uses your Personal Data for the following specific purposes:

• To create, manage, and maintain your Account on the Platform.
• To verify your identity and age (21+ requirement) as part of the mandatory KYC process.
• To process deposit and withdrawal transactions in MYR via your chosen payment method, including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong.
• To detect, investigate, and prevent fraudulent activity, money laundering, underage gambling, and other prohibited conduct.
• To administer bonus and promotional offers in accordance with applicable terms and conditions.
• To provide multilingual customer support in English, Bahasa Melayu, and Mandarin Chinese.
• To monitor your gaming activity for responsible gambling purposes and to apply account restrictions or intervention tools where indicators of problem gambling are identified.
• To comply with our legal and regulatory obligations, including reporting to financial intelligence units and regulatory bodies where required by law.
• To send you transactional communications relating to your account, such as deposit confirmations, withdrawal notifications, and security alerts.
• To send promotional and marketing communications where you have opted in to receive them. You may withdraw this consent at any time.
• To analyse platform usage, improve our services, and develop new features in response to player behaviour and feedback.

Totonito does not sell, rent, or trade your Personal Data to third parties for their own commercial or marketing purposes. We may share your Personal Data with the following categories of recipients, strictly on a need-to-know basis and under contractual obligations of confidentiality:

7.1 Service Providers

Third-party processors engaged by Totonito to provide infrastructure, payment processing, identity verification, fraud prevention, customer support software, and analytics services. All service providers are contractually required to process Personal Data solely on Totonito's instructions and to maintain appropriate security measures.

7.2 Payment Partners

Payment processors and financial institutions necessary to execute your deposit and withdrawal transactions, including FPX network participants, DuitNow operators, and e-wallet providers such as Touch 'n Go eWallet, Boost, and GrabPay. Only the data required to process the specific transaction is shared.

7.3 Regulatory & Law Enforcement Authorities

Totonito may disclose Personal Data to regulatory bodies, financial intelligence units, law enforcement agencies, or courts of competent jurisdiction where required by applicable law, or where such disclosure is necessary to protect the rights, property, or safety of Totonito, its players, or the public. Such disclosures will be made in accordance with applicable legal requirements.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of Totonito's assets, Personal Data held by Totonito may be transferred to the acquiring entity as part of that transaction. Affected players will be notified of any such transfer and any changes to this Policy that may result therefrom.

The operation of an online platform necessarily involves the transfer and processing of data across multiple jurisdictions. Some of Totonito's service providers and infrastructure partners may be located outside of Malaysia. Where Personal Data is transferred to a jurisdiction that does not provide an equivalent level of data protection, Totonito will implement appropriate safeguards to protect your data, including:

• Standard contractual clauses approved by relevant data protection authorities;
• Binding corporate rules where applicable; or
• Other lawful transfer mechanisms as recognised under applicable data protection law.

Players may request further information regarding the specific safeguards applicable to international transfers of their Personal Data by contacting our support team.

Totonito retains Personal Data only for as long as is necessary to fulfil the purposes set out in this Policy, or as required by applicable law and regulation. The following general retention periods apply:

Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised in a manner that prevents re-identification. Where anonymisation is not feasible, the data will be securely destroyed.

Totonito uses cookies and similar tracking technologies (including web beacons and local storage) to operate and improve the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function. These cookies manage your session, authentication state, security tokens, and responsible gambling limit settings. They cannot be disabled without breaking core Platform functionality.
• Analytical / Performance Cookies: Used to collect anonymised information about how players use the Platform, including pages visited, game sessions initiated, and error events. This data helps us identify technical issues and improve the user experience. These cookies do not identify you personally.
• Functional Cookies: Used to remember your preferences, such as language selection and display settings, to provide a more personalised experience on subsequent visits.

Totonito does not use third-party advertising cookies or cross-site tracking technologies. You may manage or disable non-essential cookies via your browser's cookie settings. Disabling strictly necessary cookies may impair your ability to access and use the Platform.

Totonito implements a comprehensive range of technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data in transit between your device and the Platform.
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records.
• Two-factor authentication (2FA) available for all player accounts and mandatory for all administrative accounts.
• Real-time fraud detection and anomaly monitoring systems operating across all Platform transactions and login events.
• Role-based access controls ensuring that employee access to Personal Data is limited to what is necessary for each individual's job function.
• Regular penetration testing and security audits conducted by independent third-party security specialists.
• Incident response procedures designed to detect, contain, and notify affected parties of any Personal Data breach within the timeframes required by applicable law.

Subject to applicable law and certain limited exceptions, you have the following rights in relation to your Personal Data held by Totonito:

To exercise any of these rights, please contact our support team via live chat or by email at the address provided in Section 16. We will acknowledge your request within seventy-two (72) hours and provide a substantive response within thirty (30) days. In complex cases, this period may be extended by a further thirty (30) days with prior notice.

Please note that the right to erasure and the right to portability are subject to overriding legal retention obligations, particularly those arising from AML and financial compliance requirements, which may prevent us from fully complying with a deletion request for certain categories of data.

The Totonito Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or store Personal Data relating to individuals under the age of 21. Age verification is a mandatory component of our KYC process, and accounts found to belong to individuals below the minimum age threshold will be immediately suspended, with any associated data quarantined and processed in accordance with our regulatory obligations.

If you are a parent or guardian and believe that your child has provided Personal Data to Totonito without your knowledge, please contact us immediately at the details provided in Section 16. We will take prompt action to investigate and, where confirmed, to delete the relevant data and close the account.

The Platform may contain references to or brief descriptions of third-party services (such as payment processors). Totonito does not control the privacy practices of third-party services and is not responsible for their content, privacy policies, or data handling practices. We encourage you to review the privacy policy of any third-party service before providing them with your Personal Data.

This Policy applies solely to data collected directly by Totonito through the Platform. Where you interact with third-party payment gateways (such as DuitNow, FPX, or e-wallet providers) to complete a transaction, the data you provide to those services is governed by their respective privacy policies.

Totonito reserves the right to amend this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or the services we offer. Where a material change is made to this Policy, we will notify you by displaying a prominent notice on the Platform and, where appropriate, by sending a notification to your registered email address, at least seven (7) days prior to the change taking effect.

Your continued use of the Platform following the effective date of an updated Policy constitutes your acceptance of the revised terms. We recommend reviewing this Policy periodically to stay informed about how Totonito protects your Personal Data.

The version number and effective date at the top of this page will always reflect the most current version of this Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by Totonito, please contact our Data Protection team through any of the following channels:

• Live Chat: Available 24/7, 365 days per year via the Platform. Average response time: 3–5 minutes. Supported in English, Bahasa Melayu, and Mandarin Chinese.
• Support Email: [email protected] — displayed as plain text only. Please do not click email addresses in messages purportedly from Totonito without verifying the sender's domain.
• Subject Line: When emailing regarding a privacy or data protection matter, please use the subject line "Data Privacy Request — [Your Registered Username]" to ensure your query is directed to the appropriate team.

We will acknowledge all privacy-related requests within seventy-two (72) hours and provide a full response within thirty (30) calendar days of receipt. If we require additional information to verify your identity before processing a data subject request, this period will commence from the date we receive the requested information.