Privacy Policy — How 222toto Protects Your Personal Data

1. Introduction

This Privacy Policy ("Policy") is issued by 222toto ("222toto", "we", "us", "our") and applies to all personal data collected through the 222toto online gaming and sports betting platform available at https://222toto.cam, including any mobile interfaces and associated services (collectively, the "Platform").

This Policy describes the categories of personal data we collect, the purposes for which that data is processed, the circumstances under which data may be disclosed to third parties, and the rights available to you as a data subject. It should be read in conjunction with our Terms & Conditions, which govern the overall use of the 222toto platform.

By registering an account on 222toto, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein. If you do not agree, please do not register or continue using the Platform.

2. Definitions

For the purposes of this Policy, the following definitions shall apply:

• "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, identification number, email address, contact number, and device identifiers.
• "Data Subject" means the individual to whom Personal Data relates — in most cases, a registered or prospective 222toto player.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Data Controller" means the entity that determines the purposes and means of processing Personal Data — in this case, 222toto.
• "Data Processor" means a third party that processes Personal Data on behalf of the Data Controller under documented instructions.
• "KYC" means Know Your Customer identity and age verification procedures.
• "Cookies" means small text files placed on your device by a web server to store session or preference information.

3. Data Controller

222toto acts as the Data Controller in respect of Personal Data collected through the Platform. As Data Controller, 222toto is responsible for ensuring that Personal Data is processed lawfully, fairly, and transparently in accordance with applicable data protection legislation.

Where 222toto engages third-party service providers to process Personal Data on its behalf (for example, payment processors, KYC verification partners, or analytics providers), those parties act as Data Processors and are bound by data processing agreements that restrict their use of Personal Data to the purposes specified by 222toto.

4. Data We Collect

222toto collects Personal Data across three primary categories: data you provide voluntarily, data collected automatically through your use of the Platform, and data received from third-party sources.

5. How We Collect Data

222toto collects Personal Data through the following means:

• Direct interactions: Data you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting our support team, or responding to promotional communications.
• Automated technologies: Data collected automatically as you navigate the Platform, including cookies, server logs, pixel tags, and session recording tools. This enables us to understand how players use 222toto and to improve the user experience.
• Third-party sources: Data received from payment providers (such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, and FPX processors), KYC verification partners, fraud detection services, and publicly available sources for the purposes of identity verification and fraud prevention.

6. Data Processing & Use

222toto processes your Personal Data for the following purposes:

• Account management: Creating, verifying, and maintaining your 222toto account, including authentication, security, and communication.
• KYC and age verification: Confirming that you meet the minimum age requirement of 21 years and are not subject to self-exclusion or other restrictions.
• Transaction processing: Handling deposits via Malaysian payment methods (including Touch 'n Go eWallet, Boost, GrabPay, Maybank2u, CIMB Clicks, DuitNow, FPX) and processing withdrawal requests to your verified payment method.
• Service delivery: Providing access to sports betting markets, live casino, slot games, and other gaming products available on the 222toto platform.
• Fraud prevention and security: Detecting and preventing fraudulent, abusive, or unlawful activity, including money laundering, bonus abuse, and multi-accounting.
• Regulatory compliance: Meeting our obligations under applicable anti-money laundering, responsible gambling, and data protection regulations.
• Customer support: Responding to enquiries, resolving disputes, and providing technical assistance through our 24/7 multilingual support team.
• Marketing communications: Sending promotional offers, bonus notifications, and platform updates where you have given explicit consent. You may withdraw this consent at any time.
• Platform improvement: Analysing usage patterns to improve the platform experience, fix bugs, and develop new features.

7. Legal Basis for Processing

222toto processes your Personal Data on one or more of the following legal bases, depending on the nature of the processing activity:

• Contractual necessity: Processing required to perform our contract with you, including account registration, transaction execution, and service delivery.
• Legal obligation: Processing required to comply with applicable laws and regulations, including KYC, anti-money laundering obligations, and responsible gambling requirements.
• Legitimate interests: Processing carried out in furtherance of our legitimate business interests, such as fraud prevention, platform security, and service improvement, where those interests are not overridden by your fundamental rights.
• Consent: Processing for purposes such as direct marketing communications, where you have given clear and explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

8. Data Sharing & Disclosure

222toto does not sell, rent, or disclose your Personal Data to third parties for their independent marketing purposes. We may, however, share Personal Data with the following categories of recipients where necessary and proportionate:

• Payment service providers: To process your deposit and withdrawal transactions. This includes providers of Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency payment rails. These providers receive only the data necessary to complete your transaction.
• KYC and identity verification partners: Third-party services engaged to verify your identity, age, and compliance status in connection with our regulatory obligations.
• Fraud prevention and security services: Providers engaged to detect, investigate, and prevent fraudulent, abusive, or criminal activity on the Platform.
• IT and infrastructure providers: Cloud hosting, database, and platform infrastructure providers who process data on our behalf under documented data processing agreements.
• Legal and regulatory authorities: Government bodies, law enforcement agencies, regulators, or courts where disclosure is required by applicable law or a valid legal order. 222toto will notify you of any such disclosure where legally permissible to do so.
• Professional advisers: Lawyers, auditors, and consultants bound by confidentiality obligations, where engaged for legal, compliance, or operational purposes.

All third parties with whom 222toto shares Personal Data are required to maintain appropriate security standards and to use the data only for the purposes for which it was shared.

9. Cookies & Tracking Technologies

222toto uses cookies and similar tracking technologies to operate the Platform, personalise your experience, and analyse usage. The following categories of cookies may be in use:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication cookies, security tokens, and load balancing cookies. These cannot be disabled without impairing core functionality.
• Functional cookies: Store your preferences such as language settings, preferred payment method, and display options to improve your experience on return visits.
• Analytics cookies: Collect anonymous or pseudonymous usage data to help us understand how players navigate the Platform, which features are used most, and where improvements can be made.
• Security cookies: Used to detect and prevent fraudulent sessions, protect against CSRF attacks, and monitor for unusual account activity.

You may control cookie settings through your browser preferences. Disabling certain cookies may limit the functionality of the Platform. 222toto does not use cookies to serve third-party advertising.

10. Data Retention

222toto retains your Personal Data for as long as necessary to fulfil the purposes for which it was collected, subject to any longer retention periods required by applicable law or regulatory obligation. General retention guidelines are as follows:

• Account and identity data: Retained for the duration of your account relationship with 222toto, and for a minimum of five (5) years following account closure, in compliance with anti-money laundering record-keeping requirements.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of the transaction.
• KYC documents: Retained for a minimum of five (5) years following account closure or the completion of the relevant customer relationship.
• Customer support communications: Retained for up to three (3) years from the date of the interaction, unless required for longer periods in connection with an open dispute or legal matter.
• Marketing consent records: Retained for as long as you remain an active subscriber or for three (3) years following your last interaction, whichever is earlier.

Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised so that it can no longer be attributed to you.

11. Security Measures

222toto implements a comprehensive set of technical and organisational security measures to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. These include, but are not limited to:

• Transport Layer Security (TLS 1.3) encryption for all data transmitted between your device and our servers
• AES-256 encryption for Personal Data stored at rest in our databases
• Role-based access controls limiting employee access to Personal Data on a need-to-know basis
• Multi-factor authentication requirements for administrative system access
• Regular security vulnerability assessments and penetration testing
• Intrusion detection and 24/7 security monitoring of platform infrastructure
• Documented incident response procedures for identifying, containing, and notifying affected parties in the event of a data breach

12. Your Rights as a Data Subject

Subject to applicable data protection legislation, you have the following rights in respect of your Personal Data held by 222toto. To exercise any of these rights, please contact our support team using the details in Section 16.

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is being processed.
• Right to Rectification: If any of your Personal Data is inaccurate or incomplete, you may request that it be corrected or updated.
• Right to Erasure: Subject to our legal retention obligations, you may request the deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected.
• Right to Restriction: You may request that we restrict the processing of your Personal Data in certain circumstances, for example where you contest its accuracy.
• Right to Data Portability: Where processing is based on your consent or a contract, you may request a structured copy of your Personal Data in a machine-readable format.
• Right to Object: You may object to the processing of your Personal Data where it is carried out on the basis of legitimate interests, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

222toto will respond to data subject requests within a reasonable timeframe, and in any case within 30 days of receipt. We may need to verify your identity before processing your request. Requests may be refused or limited where permitted by law, for example where fulfilment would adversely affect the rights of others or conflict with a legal obligation.

13. Minors

The 222toto platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect Personal Data from persons under the age of 21. If you are under 21, you must not register an account or use any 222toto service.

If 222toto becomes aware that Personal Data has been collected from a person under the age of 21, we will take immediate steps to delete that data, close the associated account, and return any funds deposited (net of any bonuses claimed) to the originating payment method.

Parents and guardians are encouraged to use available parental control tools to prevent minors from accessing online gambling platforms. For further guidance, please visit our Responsible Gambling page.

14. International Data Transfers

In connection with the operation of the 222toto Platform, your Personal Data may be transferred to, stored in, or processed by servers and service providers located in jurisdictions outside Malaysia. Where such transfers occur, 222toto will ensure that appropriate safeguards are in place to protect your data to a standard equivalent to that afforded under applicable Malaysian data protection requirements.

Safeguards for international transfers may include contractual protections, standard data protection clauses, or transfers to jurisdictions that have been assessed as providing an adequate level of data protection. If you would like further information about the specific safeguards applicable to any international transfer of your Personal Data, please contact us using the details in Section 16.

15. Changes to This Privacy Policy

222toto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or operational requirements. The most current version of this Policy will always be accessible on this page, with the last-updated date displayed at the top.

Where changes are material — for example, where we introduce a new category of data processing or a new purpose — we will endeavour to provide reasonable prior notice, either through a notice on the Platform or by email to your registered address. Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the amended terms.

16. Contact Us

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or would like to raise a privacy-related concern, please contact the 222toto support team. Our agents are available 24 hours a day, 7 days a week, in English, Bahasa Melayu, and Chinese.

Email: [email protected]  — plain text display; this address is not a clickable link.

Live Chat: Available directly on the 222toto Platform. Average first-response time is 3 to 5 minutes via live chat.

When contacting us to exercise a data subject right, please include your registered account username and a brief description of your request. We may require identity verification before processing your request.

For issues related to responsible gambling, self-exclusion, or deposit limits, please visit our dedicated Responsible Gambling page for specific guidance and support options.