totosakti Privacy Policy

This Privacy Policy (hereinafter "Policy") is issued by totosakti (hereinafter "totosakti", "we", "us" or "our"), the operator of the online platform accessible at https://totosakti.cam (hereinafter the "Platform"). This Policy applies to all users (hereinafter "User", "you" or "your") who access the Platform, create an account, place bets, use any associated digital service or otherwise interact with totosakti in any capacity.

totosakti recognises that privacy is a fundamental concern for all users, including those accessing the Platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and other locations across Malaysia. This Policy is designed to give you a clear and complete understanding of the personal information we hold about you, the purposes for which we use it, the parties with whom we may share it, and the choices and rights available to you.

By accessing the Platform or creating an account, you confirm that you have read and understood this Policy in its entirety. This Policy should be read alongside the totosakti Terms & Conditions.

For the purposes of this Policy, the following terms carry the meanings set out below.

totosakti collects Personal Data from you through the following channels and in the following categories:

Information you provide directly:

• Full legal name, date of birth and contact details (email address and, where required, phone number) submitted during account registration.
• Identity documents uploaded for KYC verification, including scanned copies of your MyKad, Malaysian driving licence or international passport.
• Proof of address documentation such as a utility bill or bank statement issued within the past three months.
• Selfie or live photograph where required to confirm identity document ownership.
• Correspondence with our customer support team, including the content of enquiries, complaint details and supporting evidence.
• Responsible gambling declarations, including self-stated financial limits, self-exclusion requests and any health-related disclosures you choose to make voluntarily.

Information collected automatically:

• IP address, device type, browser type and version, operating system and screen resolution.
• Pages visited, time spent on each page, referring URL, session duration and clickstream data collected through first-party analytics.
• Cookie identifiers and similar tracking data as described in Section 6.
• Geolocation data at the city or country level derived from your IP address, used to support access controls and compliance screening.

Information received from third parties:

• Identity verification results from contracted KYC and anti-fraud service providers.
• Transaction data from payment processors and financial institutions including DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, Touch 'n Go eWallet, Boost and GrabPay, as applicable.
• Fraud and sanctions screening data from third-party compliance databases where legally permissible.

totosakti processes your Personal Data for the following purposes and, in each case, on the legal basis identified:

When you make a deposit or request a withdrawal using any supported MYR payment channel — including DuitNow, FPX, Maybank online banking, CIMB Clicks, Public Bank Internet Banking, Hong Leong Connect, Touch 'n Go eWallet, Boost, GrabPay or any supported cryptocurrency network — totosakti receives transaction data from the relevant payment processor.

totosakti does not store full card numbers or complete bank account credentials on its own servers. Payment instrument data is handled exclusively by our contracted payment service providers, who operate under their own security and data protection obligations. totosakti receives and retains only the transaction identifiers, amounts, timestamps and status codes necessary for reconciliation and compliance.

KYC documentation — including identity photographs and address evidence — is stored in an access-controlled environment. Access is restricted to personnel with a legitimate operational or compliance need. KYC documents are not shared with third parties except as required by law or applicable regulatory direction.

totosakti uses cookies and similar technologies to support the operation and improvement of the Platform. A cookie is a small text file stored on your device by your browser when you visit a website. The following categories of cookies may be active on the Platform:

• Strictly necessary cookies: Required for core Platform functions such as maintaining your login session, applying your preferred language or currency setting, and supporting security features. These cannot be disabled without materially impairing your experience.
• Analytics cookies: Used to collect aggregated data on how users navigate and interact with the Platform, allowing totosakti to identify and resolve usability issues and improve content relevance. Data collected is not linked to individual identities where possible.
• Functional cookies: Remember preferences you have set during your session or across sessions, such as display settings and responsible gambling limits you have configured.
• Marketing cookies: Used only where you have opted in to receiving personalised offers or promotional communications. These cookies track whether you have viewed or acted on a particular offer.

You may manage cookie preferences through your browser settings at any time. Note that disabling strictly necessary cookies may prevent certain Platform features from functioning correctly. Specific opt-out mechanisms are also available through the Platform's cookie preference centre where provided.

totosakti does not sell or rent Personal Data to third parties. We may share Personal Data with the following categories of recipient, strictly on a need-to-know basis and subject to binding contractual protections:

• Payment processors: DuitNow, FPX network participants, and contracted eWallet operators require transaction data to process deposits and withdrawals.
• Identity verification providers: Third-party KYC and anti-fraud services receive identity document data to complete verification checks required by our compliance obligations.
• Technology and infrastructure providers: Cloud hosting, content delivery and customer support platform vendors may process data on our behalf under data processing agreements that restrict their use of Personal Data.
• Regulatory and law enforcement authorities: Where legally compelled by applicable Malaysian law, court order or regulatory direction, totosakti will disclose Personal Data to the relevant authority. We will notify you of any such disclosure where legally permitted to do so.
• Professional advisers: Legal counsel, auditors and compliance consultants engaged by totosakti may access Personal Data where strictly necessary for their professional mandate, subject to professional confidentiality obligations.

Where Personal Data is transferred to service providers operating infrastructure outside Malaysia, totosakti will implement appropriate safeguards to ensure that the transfer meets applicable legal standards for cross-border data transfers.

Subject to applicable law and the specific circumstances of your request, you hold the following rights in relation to your Personal Data held by totosakti:

To exercise any of the above rights, please contact us at the address in Section 13. totosakti will respond to all valid requests within a reasonable timeframe, typically within 30 calendar days. Identity verification may be required before a request can be fulfilled to ensure we do not disclose data to unauthorised parties.

totosakti retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, comply with applicable legal obligations or pursue legitimate interests in accordance with this Policy. The schedule below provides indicative retention horizons; specific legal requirements may extend these periods.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised so that it can no longer be attributed to any individual.

totosakti implements appropriate technical and organisational measures to protect Personal Data against unauthorised access, accidental loss, destruction, alteration or disclosure. Measures in place include, but are not limited to:

• Transport Layer Security (TLS/HTTPS) encryption for all data transmitted between your device and totosakti servers.
• Encryption of sensitive Personal Data at rest using accepted cryptographic standards.
• Role-based access controls restricting staff access to Personal Data to the minimum necessary for their specific function.
• Regular security assessments and penetration testing of Platform infrastructure.
• Multi-factor authentication requirements for administrative access to systems holding Personal Data.
• Incident response procedures with defined timelines for breach notification where legally required.

While totosakti maintains robust security practices, no digital platform can guarantee absolute security. We encourage you to use a strong, unique password for your totosakti account and to avoid accessing the Platform on unsecured public networks. Never disclose your login credentials or one-time codes to any third party.

totosakti strictly prohibits the use of the Platform by any person under 21 years of age. We do not knowingly collect Personal Data from individuals under 21. Where totosakti becomes aware that an account has been opened by an underage person, we will immediately suspend the account, delete or quarantine any associated Personal Data where legally permissible, and handle any associated balance in accordance with applicable Terms & Conditions.

If you are a parent or guardian and have reason to believe that a minor has provided Personal Data to totosakti or has accessed the Platform, please contact us immediately using the details in Section 13.

totosakti reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable law or Platform functionality. When a material change is made, we will update the "Last updated" date shown at the top of this page and, where reasonably practicable, notify registered users by email or by a prominent notice on the Platform.

We encourage you to review this Policy periodically. Continued use of the Platform after an updated Policy has been posted constitutes your acknowledgement of the changes. If you have material objections to any revision, you should discontinue use of the Platform and contact us regarding account closure.

If you have any questions, concerns or formal requests relating to this Privacy Policy or to the Personal Data that totosakti holds about you, please contact our data compliance team through the following channel:

Please include your registered username, a clear description of your request and any supporting information to allow accurate identification of your account. totosakti aims to acknowledge all privacy-related correspondence within two business days and to provide a substantive response within 30 calendar days.

For general account queries, payment questions and platform usage guidance, you may also consult the FAQ page.