Privacy Policy — totolotre Platform

This Privacy Policy ("Policy") issued by totolotre ("we", "us", "our", "the Platform") and governs the collection, processing, storage, use, and disclosure of personal data pertaining to users ("you", "your", "Player") who access or use the totolotre website and services available at https://totolotre.cam.

totolotre operates as an online gaming and sports betting platform serving players primarily across Malaysia — including Kuala Lumpur, Petaling Jaya, Shah Alam, Penang, Johor Bahru, and the broader Malaysian market. In providing our services, we necessarily collect and process certain personal information. This Policy explains that process with full transparency.

By registering an Account or continuing to use theotolotre platform, you acknowledge that you have read, understood, and agreed to the data practices described in this Policy. This Policy is to be read in conjunction with our Terms & Conditions, which are incorporated herein by reference.

The following terms shall carry the meanings set out below throughout this Privacy Policy:

totolotre collects personal data through several channels: directly from you during registration and account management, automatically through your use of the Platform, and from third-party identity verification and payment processing partners. The categories of personal data we collect are set out in the table below.

totolotre does not collect payment card numbers directly. All card processing — where applicable — is handled exclusively by certified, PCI-DS-compliant third-party payment processors. Card details are never stored on totolotre's servers.

totolotre uses the personal data we collect for the following purposes. We apply the principle of data minimisation — we use only the data necessary for each stated purpose and do not process personal data in ways that are incompatible with these stated purposes.

• Account Creation and Management: To register your account, verify your identity, and maintain accurate account records throughout your relationship with totolotre.
• Service Provision: To process deposits and withdrawals via Malaysian payment methods (including Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, and Hong Leong), provide access to games, settle bets, and deliver account-related services.
• Identity Verification (KYC): To verify your identity and age (21+) in compliance with our anti-money laundering, fraud prevention, and responsible gambling obligations.
• Fraud and Security Monitoring: To detect, investigate, and prevent fraudulent activity, account misuse, money laundering, and other security threats to the Platform and its users.
• Regulatory Compliance: To fulfil our obligations under applicable laws, including retaining transaction records and responding to lawful requests from authorities.
• Customer Support: To respond to queries, resolve disputes, and provide support in English, Bahasa Melayu, and Mandarin Chinese via live chat, WhatsApp, and email.
• Responsible Gambling: To monitor gaming behaviour, enforce deposit limits and self-exclusion requests, and identify indicators of problem gambling to fulfil our duty of care obligations.
• Platform Improvement: To analyse usage patterns, test new features, and improve the performance, stability, and user experience of the Platform for Malaysian players.
• Communications: To send account-related notifications, security alerts, and — where you have provided consent — promotional communications about offers relevant to your account activity.

totolotre processes personal data on the following legal bases, in accordance with applicable data protection principles:

totolotre does not sell, trade, or disclose your personal data to unaffiliated third parties for commercial gain. We share personal data only in the following limited and controlled circumstances:

To facilitate deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, and cryptocurrency networks, we share necessary transaction data with the relevant payment service providers. These processors operate under their own privacy policies and are bound by contractual data protection obligations.

KYC document verification may be conducted with the assistance of certified third-party identity verification providers. These providers process document images and biometric data solely for the purpose of verifying identity and age, under strict confidentiality agreements with totolotre.

totolotre engages cloud hosting, content delivery, and software service providers to operate the Platform's technical infrastructure. These providers access personal data only as necessary to provide their services and are prohibited from using that data for their own purposes.

Certified game studio partners integrated into the Platform may receive limited session data (such as player identifiers and bet amounts) for the purpose of game functionality, bet settlement, and RTP reporting. No unnecessary personal identifiers are shared beyond what is required for game operation.

totolotre will disclose personal data when required to do so by applicable law, court order, regulatory directive, or lawful request from competent authorities. We will notify you of such disclosure requests where legally permitted to do so.

totolotre retains personal data for as long as necessary to fulfil the purposes set out in this Policy and to comply with our legal obligations. The following general retention guidelines apply:

• Active Account Data: Retained throughout the duration of your account relationship with totolotre and updated as necessary to maintain accuracy.
• KYC Documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later, in accordance with AML compliance obligations.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in accordance with applicable financial record-keeping requirements.
• Support Communication Records: Retained for three (3) years from the date of each interaction for quality assurance and dispute resolution purposes.
• Technical Logs: Retained for up to twelve (12) months, after which they are anonymised or deleted unless required for an ongoing investigation.
• Responsible Gambling Records: Self-exclusion and limit records are retained for the duration of the exclusion period and for a minimum of three (3) years thereafter, to prevent re-registration during active exclusion periods.

Upon the expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be linked to any identifiable individual.

totolotre implements robust technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. Our key security controls include:

• Transport Encryption: All data transmitted between your device and totolotre's servers is protected by256-bit SSL/TLS encryption. The Platform operates exclusively over HTTPS.
• Password Security: Account passwords are stored using industry-standard one-way cryptographic hashing. Plaintext passwords are never stored or accessible to totolotre staff.
• Access Controls: Access to systems holding personal data is restricted to authorised personnel on a strict need-to-know basis. Access logs are maintained and reviewed regularly.
• Infrastructure Security: Our hosting infrastructure is protected by firewalls, intrusion detection systems, and regular vulnerability assessments. Security patches are applied promptly upon release.
• Payment Security: totolotre does not store payment card data. All card-based transactions are routed through PCI-DSS certified payment processors. E-wallet and DuitNow transactions use the security infrastructure of the respective payment provider.
• Incident Response: In the event of a data security incident, totolotre maintains a documented incident response procedure. Affected users will be notified in accordance with applicable notification obligations.

totolotre uses cookies and similar tracking technologies to operate the Platform effectively and to understand how users interact with our services. The following categories of cookies are used:

These cookies are essential to the operation of the Platform and cannot be switched off. They are typically set in response to user actions such as logging in, setting deposit limits, or navigating between game categories. Without these cookies, the Platform cannot function correctly.

These cookies collect aggregated, anonymised information about how users navigate the Platform — which pages are visited most frequently, how long sessions last, and where users encounter errors. This data is used solely to improve Platform performance and user experience. No individual user is identifiable from analytics data.

These cookies remember your preferences — such as language selection, display settings, and recently played game categories — to provide a personalised experience on return visits.

You may configure your browser settings to refuse or delete cookies at any time. Instructions for managing cookies in major browsers (Chrome, Firefox, Safari, Edge) are available in each browser's help documentation. Please note that disabling strictly necessary cookies will impair the functionality of the Platform and may prevent you from accessing certain features.

totolotre recognises and respects your rights in relation to your personal data. You may exercise any of the following rights by submitting a written request to support@totolotre.cam. We will respond to all verifiable requests within 30 calendar days:

• Right of Access: You may request a copy of the personal data totolotre holds about you, together with information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data held your account. Certain corrections (such as name changes) may require supporting documentation.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent that formed the sole legal basis for processing. Please note that certain data must be retained for legal and compliance reasons (see Section 7) even following an erasure request.
• Right to Restriction of Processing: You may request that totolotre limit the processing of your personal data in certain circumstances — for example, while the accuracy of your data is being verified following a rectification request.
• Right to Data Portability: Where processing is based on consent or contractual necessity and is carried out by automated means, you may request your personal data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing. Where you object to marketing communications, we will cease such communications promptly.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact us at the details provided in Section 14 of this Policy. We may require you to verify your identity before processing a request, to ensure we do not disclose or alter data belonging to another individual.

totolotre operates a strict21+ age policy. The Platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 21. Account registration requires users to declare their age, and KYC verification is used to confirm that declaration.

Parents and guardians who have reason to believe that a minor has created an account on totolotre are encouraged to contact us immediately at support@totolotre.cam. We will investigate and take appropriate action promptly.

In certain circumstances, personal data held by totolotre may be processed or stored on servers or by service providers located outside Malaysia. Where such cross-border transfers occur, totolotre ensures that appropriate safeguards are in place to protect personal data to a standard equivalent to that provided under Malaysian data protection principles.

Safeguards employed for international transfers include contractual data protection clauses incorporated into agreements with all third-party processors and hosting providers, restricting the use of transferred data to the stated processing purposes.

totolotre reserves the right to update or revise this Privacy Policy from time to time to reflect changes in our data practices, applicable laws, or Platform features. The date of the most recent revision is displayed at the top of this page.

Where changes are material — for example, a new category of data processing or a change to your rights — we will notify registered Players by email or through a prominent notice on the Platform at least 14 days before the updated Policy takes effect. Continued use of the Platform following the effective date of an updated Policy constitutes your acceptance of the revised terms.

We encourage you to review this Policy periodically to stay informed about how totolotre handles your personal information.

For any queries, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact totolotre through any of the following channels. All data-related requests are handled with priority and in accordance with our response time commitments.