Privacy Policy totosaja – Our Commitment to Your Data Security

Totosaja is an online entertainment platform providing slots, Live Casino, Sports Betting, lottery and baccarat services to users in Malaysia. In delivering these services, we need to collect and process certain personal information about our users.

This Privacy Policy outlines our commitment to protecting your personal data in accordance with industry best practices and applicable legal requirements. We hold firmly to the principle that your personal data belongs to you — we are simply its custodians, and we take that responsibility seriously.

Totosaja only collects data that is genuinely necessary to operate our services safely and effectively. The following are the categories of data we collect and the reasons for doing so:

• Registration Data: Full name, email address, phone number, and date of birth. This information is required to create your totosaja account and verify your age eligibility.
• Identity Verification Data: A copy of your IC or passport may be required for account verification or large withdrawals. This is standard industry procedure to prevent fraud and money laundering.
• Payment Data: Information relating to the payment method you use — Touch 'n Go eWallet, DuitNow, GrabPay, FPX, Boost, or ShopeePay. We do not store your full account number or payment method password.
• Platform Activity Data: Game history, betting records, deposit and withdrawal history. This data is required to operate the service, resolve disputes and meet audit requirements.
• Technical Data: IP address, browser type, operating system, session data and cookies. This data is used to maintain platform security, detect fraud and improve the user experience.
• Communication Data: Your correspondence with Totosaja's support team, including emails, live chat logs and complaint records. These are retained for reference and service improvement purposes.

The data we collect is used for specific and limited purposes. Totosaja does not use your data for purposes unrelated to the provision and improvement of our platform services. The following are the primary purposes for which data is used:

• Account Management: Creating and managing your Totosaja account, verifying your identity, processing deposits and withdrawals, and running all platform functions.
• Security & Fraud Prevention: Detecting and preventing unauthorised access, fraud, money laundering, and platform abuse that could harm you or other members.
• Legal Compliance: Meeting applicable legal and regulatory obligations, including anti-money laundering requirements and age verification.
• Customer Support: Resolving inquiries, complaints and technical issues that you raise with the Totosaja support team.
• Responsible Gaming: Monitors play patterns to identify signs of problem gambling and reach out to members who may need assistance, in line with our commitment to member well-being.
• Platform Improvements: Analysing aggregated (not individual) usage data to understand how members use the platform and identify areas for improvement.
• Marketing Communications: Sending information about Totosaja promotions, bonuses and special offers — only to members who have agreed to receive such communications. You may unsubscribe at any time.

Totosaja processes your personal data on several valid legal bases, depending on the purpose of the processing:

• Contract Performance: Most of the data processing we carry out is necessary to perform the service agreement between you and Totosaja — that is, to provide the gaming platform, process payments and manage your account.
• Legitimate Interests: Some data processing is carried out on the basis of Totosaja's legitimate interests — such as fraud prevention, security analysis and service improvement — in ways that do not infringe on your fundamental privacy rights.
• Legal Compliance: Some data processing is mandatory to fulfil the legal obligations placed on totosaja as a licensed online entertainment platform operator.
• Consent: For marketing communications and preference-related purposes, we rely on your explicit consent, which you may withdraw at any time without affecting your core access to the platform.

Totosaja takes a highly cautious approach to sharing member data with third parties. Our core principle is straightforward — we do not share your data unless there is a legitimate need and you have been informed. The following are situations where your data may be shared:

• Payment Service Providers: Providers such as Touch 'n Go eWallet, DuitNow, and GrabPay receive only the transaction data strictly necessary to process your deposits and withdrawals. These providers maintain their own privacy policies and are bound by strict data protection agreements with totosaja.
• Game Providers: Slots and Live Casino providers such as Pragmatic Play, NetEnt and Microgaming may receive session data required to run games and verify winnings. No additional personal information beyond what is necessary is shared.
• Legal Authorities: totosaja will disclose required data to Malaysian authorities if mandated by a court order, legal requirement, or in the course of a legitimate criminal investigation. We do not make such disclosures voluntarily unless required by law.
• Security & Verification Providers: Third-party services that help us detect fraud, verify identities and maintain platform security may receive limited data strictly necessary for those functions.

Totosaja continually invests in security infrastructure to keep your data safe. The technical and organisational measures we employ include:

• Data Encryption in Transit: All data transmitted between your browser and Totosaja's servers is protected with TLS 1.3 encryption — the latest and most secure version of the web security protocol.
• Data Encryption at Rest: Sensitive data stored in the totosaja database — including payment information and identity verification documents — is encrypted using military-grade encryption algorithms.
• Internal Access Controls: Employee access to member data is strictly limited under the principle of least privilege — each employee can only access the data required to perform their specific role.
• Monitoring & Threat Detection: Our security monitoring system operates 24 hours a day to detect suspicious activity, intrusion attempts and anomalies in data access patterns.
• Regular Backups: Member data is backed up regularly to separate, secure locations to ensure it can be recovered in the event of an unexpected incident.

Regarding retention periods, Totosaja retains member data for as long as necessary to fulfil the purpose for which it was collected — typically for the duration your account is active, plus any additional period required by law. When data is no longer needed, it is securely deleted or anonymised in accordance with established procedures.

Totosaja uses cookies and similar tracking technologies to ensure the platform functions correctly and to deliver a better user experience. The following are the types of cookies we use:

• Essential Cookies: Required for the Totosaja platform to function — including maintaining your login session, remembering your language preferences and processing transactions. These cookies cannot be disabled without affecting core platform functionality.
• Analytics Cookies: Helps us understand how members use the platform — most visited pages, common navigation paths and areas that may present difficulties. This data is collected in aggregate and is not linked to individual identities.
• Functional Cookies: Allowing the platform to remember your preferences — such as game favourites, display settings and interface language — so your experience feels personalised every time you visit Totosaja.
• Security Cookies: Used to detect and prevent fraudulent activity, monitor suspicious login attempts and protect your account from unauthorised access.

You can manage your cookie settings through your browser settings. However, disabling certain cookies may affect the functionality of some parts of the totosaja platform. For the best experience, we recommend allowing at least essential and security cookies.

You have certain rights regarding the personal data Totosaja holds about you. We respect these rights and will handle your requests promptly and transparently:

• Right to Access: You have the right to request a copy of all personal data totosaja holds about you. We will provide this in a readable format within 14 business days of the request date.
• Right to Rectification: If you find that any data we hold about you is inaccurate or outdated, you have the right to request a correction. You may also update basic information through your Totosaja account settings.
• Right to Erasure: Under certain circumstances, you have the right to request the deletion of your personal data from Totosaja's systems. Please note that we may need to retain certain data to fulfil legal obligations even after your account is closed.
• Right to Opt Out of Marketing: You may opt out of receiving marketing communications from Totosaja at any time by using the unsubscribe link in our emails or by contacting our support team. Opting out does not affect core services.
• Right to Restrict Processing: In certain circumstances, you have the right to request that totosaja restrict how we process your data while a dispute or review is being resolved.
• Right to Data Portability: You have the right to receive your personal data in a structured, portable format that can be transferred to another service provider should you choose to do so.

To exercise any of the above rights, please contact the totosaja privacy team by email at support@totosaja.best, clearly stating your request and the identity verification details required. We will acknowledge receipt of your request within 2 business days and resolve it within 14 business days.

Totosaja is a platform exclusively for individuals aged 18 and above. We do not knowingly collect, process or store any personal data from individuals under the age of 18.

If we discover that an individual under the age of 18 has registered an account on totosaja or has provided us with their personal data, the account will be closed immediately and all related data will be deleted from our systems within a reasonable timeframe.

Totosaja reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the technologies we use. We are committed to notifying members of any significant changes.

• When significant changes occur, we will notify all active members via their registered email at least 7 days before the changes take effect.
• The date of the latest update is always displayed at the top of this page and in the information box on the right-hand side.
• Previous versions of this Privacy Policy will be retained and can be requested by emailing our support team for historical reference if needed.
• Continued use of the Totosaja platform after the effective date of any amendment constitutes acceptance of the updated Privacy Policy.

If you have any questions, concerns or requests regarding your privacy and personal data protection at Totosaja, we are here to help. Our privacy team can be reached via:

• Email: support@totosaja.best — please include "Privacy Inquiry" in your email subject line to help us process your request promptly.
• Live Chat: Accessible directly through the totosaja platform, available 24 hours a day, 7 days a week in Bahasa Melayu.
• Response Time: We aim to acknowledge receipt of all privacy enquiries within 2 business days and provide a full response within 14 business days.

We welcome your feedback on this Privacy Policy. If you feel we have not upheld the privacy commitments stated here, please let us know so we can take the appropriate corrective action. Your trust is our priority at Totosaja.