1. Introduction
This Privacy Policy ("Policy") describes how top1toto ("we", "us", "our"), the operator of the online gaming platform accessible at top1toto.cam, collects, uses, stores, and protects the personal data of individuals ("Members", "users", "you") who access or use our Platform.
top1toto is committed to protecting the privacy and security of all personal data entrusted to us. We process personal data in accordance with applicable data protection legislation and privacy best practices, and we are transparent about our data handling activities.
By registering an account on top1toto or continuing to use the Platform, you acknowledge that you have read and understood this Policy. This Policy should be read alongside our Terms & Conditions and our Responsible Gambling guidelines, which together govern your use of the top1toto Platform.
2. Definitions
For the purposes of this Privacy Policy, the following definitions apply:
3. Categories of Personal Data We Collect
top1toto collects and processes the following categories of personal data from Members and Platform users:
| Data Category | Specific Data Points | Purpose |
|---|---|---|
| Registration Data | Full name, date of birth, email address, phone number, username, password (hashed) | Account creation and authentication |
| Identity Verification (KYC) | Malaysian IC (MyKad) number and copy, selfie/photo, proof of address | Age verification, AML compliance, fraud prevention |
| Financial Data | Bank account details, e-wallet identifiers (TnG, Boost, GrabPay), transaction history, deposit and withdrawal amounts in MYR | Payment processing, withdrawal verification, AML monitoring |
| Device & Technical Data | IP address, device type, operating system, browser type, session timestamps | Security, fraud detection, platform optimisation |
| Usage Data | Games played, betting history, pages visited, session duration, feature interactions | Personalisation, responsible gambling monitoring, product improvement |
| Communications Data | Support chat transcripts, email correspondence, dispute records | Customer service, dispute resolution, quality assurance |
We only collect personal data that is necessary for the purposes described in this Policy. We do not collect sensitive categories of personal data (such as health data or racial origin) unless specifically required for responsible gambling assessments, and only with your explicit consent in such cases.
4. How We Collect Your Personal Data
top1toto collects personal data through the following channels:
- Account Registration: When you create an account on top1toto, you directly provide your name, contact details, date of birth, and chosen credentials.
- KYC Submission: When you submit identity documents to complete our mandatory KYC verification process prior to withdrawal.
- Deposits and Withdrawals: When you make financial transactions via Malaysian payment methods including DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, Touch 'n Go eWallet, Boost, GrabPay, Visa, Mastercard, and cryptocurrency wallets.
- Platform Usage: Automatically collected as you navigate and interact with the Platform, including game sessions, bet placements, and page visits.
- Customer Support Interactions: When you contact our support team via live chat, email, or any other communication channel we provide.
- Cookies and Similar Technologies: Through session cookies, functional cookies, and analytics tools used to operate and improve the Platform. Please refer to Section 9 of this Policy for full details.
5. How We Use Your Personal Data
top1toto uses the personal data we collect for the following purposes:
- Account Management: To create, maintain, and administer your top1toto account, including authentication, password recovery, and profile management.
- Payment Processing: To process deposits and withdrawals via your chosen Malaysian payment method — including verifying transactions, investigating discrepancies, and liaising with payment processors such as DuitNow, FPX operators, and local banks.
- Identity Verification and Fraud Prevention: To verify your age, identity, and the legitimacy of your payment methods in compliance with anti-money laundering (AML) obligations and to prevent fraudulent activity on the Platform.
- Platform Operation and Improvement: To deliver gaming services, analyse usage patterns, identify technical issues, and develop new features that improve the experience for Malaysian players.
- Customer Support: To respond to your enquiries, resolve disputes, process complaints, and improve service quality based on feedback and support interaction data.
- Responsible Gambling Monitoring: To monitor gambling patterns for indicators of problem gambling behaviour and, where appropriate, to make contact regarding available support tools such as deposit limits and self-exclusion. This is a duty of care we take seriously.
- Marketing Communications: Where you have provided consent, to send you information about promotions, bonuses, and new features on the Platform. You may withdraw consent to marketing communications at any time by contacting support or updating your communication preferences.
- Legal and Regulatory Compliance: To fulfil our obligations under applicable laws, respond to lawful requests from competent authorities, and maintain records as required by regulation.
6. Legal Basis for Processing
top1toto processes personal data on the following legal bases:
7. Disclosure & Data Sharing
top1toto does not sell, rent, or trade your personal data to unaffiliated third parties for commercial or marketing purposes. We share personal data only in the following limited circumstances:
- Payment Processors: We share necessary financial and identity data with our payment processing partners — including FPX operators, DuitNow-connected banks (Maybank, CIMB, Public Bank, Hong Leong), e-wallet providers (Touch 'n Go, Boost, GrabPay), and card networks — solely for the purpose of processing your transactions.
- KYC and Identity Verification Providers: We engage third-party KYC service providers to assist with identity document verification and age confirmation. These providers process your data under strict data processing agreements with top1toto.
- Cloud and Hosting Infrastructure: Our Platform operates on third-party cloud infrastructure providers. These providers store and process Platform data under contractual obligations that require them to maintain appropriate security standards.
- Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, or the lawful request of a competent authority (including financial intelligence units and law enforcement agencies), we will disclose personal data to the extent required and permitted by law.
- Professional Advisers: We may share personal data with our legal, accounting, or auditing advisers where necessary to obtain professional advice, under obligations of professional confidentiality.
8. Data Retention
top1toto retains personal data for as long as necessary to fulfil the purposes for which it was collected, including legal, regulatory, accounting, and dispute resolution requirements. Our general retention periods are as follows:
- Active Account Data: Retained for the duration of the Member's active account relationship with top1toto.
- Post-Closure Account Data: Following account closure, we retain registration data, KYC documents, and transaction records for a minimum of five (5) years in compliance with applicable anti-money laundering record-keeping requirements.
- Customer Support Records: Retained for a minimum of three (3) years following resolution of the relevant interaction or dispute.
- Marketing Consent Records: Retained for as long as necessary to demonstrate the existence of consent, typically for the duration of the marketing relationship plus three (3) years following withdrawal of consent.
- Device and Technical Logs: Retained for up to twelve (12) months for security and fraud detection purposes, after which they are anonymised or deleted.
Where retention beyond the above periods is required due to an ongoing legal dispute, regulatory investigation, or other legitimate reason, data will be retained until the conclusion of such proceedings.
9. Cookies & Tracking Technologies
top1toto uses cookies and similar technologies to operate and improve the Platform. The following types of cookies are used:
top1toto does not use third-party advertising cookies, cross-site tracking technologies, or behavioural advertising trackers of any kind. You can manage or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies may impact your ability to use the Platform.
10. Data Security
top1toto implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security framework includes:
- Encryption in Transit: All data transmitted between your device and the top1toto Platform is encrypted using TLS 1.3 with 256-bit SSL certificates.
- Encryption at Rest: Personal data and financial records stored in our databases are encrypted using AES-256 encryption.
- Access Controls: Access to personal data is restricted to authorised top1toto personnel on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations.
- Security Audits: Our Platform infrastructure undergoes regular security audits and penetration testing by qualified security professionals.
- Incident Response: We maintain a documented data breach response procedure. In the event of a personal data breach that presents a risk to your rights and freedoms, we will notify affected Members promptly.
11. Your Data Rights
Subject to applicable law, you have the following rights in relation to the personal data top1toto holds about you:
- Right of Access: You have the right to request a copy of the personal data we hold about you, together with information about how we use it. We will respond to verified access requests within thirty (30) days.
- Right to Rectification: You have the right to request the correction of any inaccurate or incomplete personal data we hold about you. You may update many of your account details directly through your Account settings.
- Right to Erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and no other legal basis for processing exists. Please note that we may be required to retain certain data to fulfil legal and regulatory obligations even following such a request.
- Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
- Right to Object: You have the right to object to processing carried out on the basis of our legitimate interests. Where you raise such an objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
- Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.
- Right to Data Portability: Where technically feasible and where processing is based on consent or contract performance, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
To exercise any of the above rights, please contact the top1toto support team via live chat or email. We may be required to verify your identity before processing your request. We will not charge a fee for handling data rights requests unless they are manifestly unfounded or excessive.
12. Children's Privacy
top1toto is strictly an adult platform. Registration, use of the Platform, and participation in any gaming activity is restricted to individuals aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21.
Age verification is a mandatory step in our KYC process. All members are required to submit documentary evidence of age prior to the processing of their first withdrawal. Where top1toto has reason to believe that a Member is under the age of 21, the Account will be immediately suspended pending investigation and, where underage access is confirmed, permanently closed.
13. Changes to This Privacy Policy
top1toto reserves the right to amend this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the scope of our Platform services. The date of the most recent revision will be clearly displayed at the top of this page.
Where changes to this Policy are material — meaning they significantly affect the way we use your personal data or your rights in relation to that data — we will notify you by email to your registered address or via a prominent notice on the Platform, prior to the changes taking effect.
Your continued use of the top1toto Platform following notification of changes to this Policy constitutes your acceptance of the revised Policy. If you do not agree with the revised Policy, you should cease using the Platform and request Account closure.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the way top1toto processes your personal data, please do not hesitate to contact us. We are committed to addressing all privacy-related enquiries promptly and transparently.
Live Chat: Available 24 hours a day, 7 days a week via the Platform
Response Time: We endeavour to respond to all email enquiries within 48 hours and to data rights requests within 30 days of receipt.
When contacting us regarding a data rights request, please include your registered email address, the nature of your request, and sufficient information to allow us to verify your identity. This is necessary to ensure we only release or modify data in response to verified requests from the account holder.