TaxiToto Privacy Policy – Malaysian User Personal Data Protection

1 Introduction and Scope of This Policy

This Privacy Policy ("Policy") describes the privacy practices of TaxiToto ("we", "Company") regarding the collection, use, storage, protection, and disclosure of personal information of users ("you") who access or use the TaxiToto platform and services.

We operate in accordance with Malaysia's Personal Data Protection Act 2010 (PDPA) and take this responsibility seriously. Every aspect of how we handle your data is designed to respect your privacy while enabling us to deliver the best and most secure service possible.

By using the TaxiToto platform, you agree to the practices described in this Policy. If you do not agree with any part of this Policy, please discontinue use of our platform.

2 Types of Personal Data We Collect

TaxiToto collects your personal data through various methods and in various contexts. Here is a breakdown of the types of data we may collect:

Data You Provide Directly

• Identity information: full name, date of birth, gender, IC or passport number
• Contact information: email address, phone number, residential address
• Financial information: bank account number, e-wallet details (for payment processing purposes only)
• KYC documents: copy of identification card, proof of address, bank statement
• Login information: username and password (stored in encrypted form — we do not store your password in plain text)

Automatically Collected Data

• Device information: device type, operating system, browser model
• Usage data: pages visited, time spent, gameplay patterns, betting history
• Network information: IP address, estimated location based on IP, ISP information
• Cookie data and similar tracking technologies (see Section 5 for further details)

3 Purpose and Legal Basis for Data Use

TaxiToto uses your personal data only for legitimate and necessary purposes. Below are the key purposes and their respective legal basis:

• Service Provision — Manages your account, processes deposits and withdrawals, and gives you access to all platform features. This is a core contractual requirement.
• Identity Verification (KYC) — Verifies your identity in accordance with anti-money laundering (AML) laws and regulatory compliance requirements. This is a legal obligation.
• Security and Fraud Prevention — Detects and prevents fraudulent activity, unauthorized use, or other security threats to your account and the platform as a whole.
• Service Communications — Sends important notifications related to your account, security updates, and transaction information. This type of communication cannot be opted out of as it forms part of the service.
• Marketing (with consent) — Sends information about promotions, bonuses, and new offers. You can unsubscribe from marketing communications at any time via your account settings.
• Responsible Gaming — Monitors gameplay patterns to detect signs of problem gambling and to comply with responsible gaming requirements.
• Platform Improvements — Analyzes aggregate and anonymized usage patterns to improve the user experience.

4 Data Sharing and Disclosure to Third Parties

TaxiToto does not sell or trade your personal data. However, in the course of normal service operations, we may share your data with the following categories of third parties, subject to strict confidentiality agreements:

• Payment Processing Providers — To process your deposits and withdrawals securely. Only data necessary for the relevant transaction is shared.
• KYC Service Providers — For identity verification and anti-money laundering checks in accordance with regulatory requirements.
• Gaming Technology and Software Providers — Our game partners may receive the minimum usage data necessary to provide their games.
• Competent Authorities — Where required by law, court order, or official request from a legitimate law enforcement agency.

5 Cookies, Tracking, and Similar Technologies

The TaxiToto platform uses cookies and similar tracking technologies to enhance your experience and ensure platform features function correctly.

Types of Cookies We Use

• Essential Cookies — Required for core platform functions such as session login and security. Cannot be disabled.
• Performance Cookies — Collects information about how you use the platform (without personally identifying you) to help us improve our services.
• Functional Cookies — Saves your preferences such as language and display settings for a more personalized experience.
• Analytics Cookies — Used to understand aggregate usage patterns for platform improvement purposes.

You can manage or disable most cookies through your browser settings. However, disabling essential cookies may affect platform functionality.

6 Our Data Security Measures

TaxiToto invests seriously in security infrastructure to protect your data. The technical and organisational measures we have implemented include:

• Data encryption in transit using TLS/SSL 256-bit protocols
• Encryption of data at rest for sensitive information stored in our databases
• Two-factor authentication (2FA) for user account access
• Strict role-based access control (RBAC) for internal staff
• 24/7 security monitoring and intrusion detection system (IDS)
• Regular security audits by independent third parties
• A comprehensive incident response plan to handle any security breaches

7 Data Retention Period

TaxiToto retains your personal data only for as long as necessary to fulfil the purpose for which it was collected and to comply with our legal obligations. The following are general retention period guidelines:

• Active Account Data — Retained for as long as your account is active and for a defined period after account closure for compliance purposes.
• Financial Transaction Records — Retained for a minimum of 7 years in accordance with Malaysia's financial and tax legal requirements.
• KYC Documents — Retained for a minimum of 5 years after the end of the business relationship in accordance with AML requirements.
• Security Logs — Retained for 12 months for investigation and dispute resolution purposes.
• Marketing Data — Deleted within 30 days after you withdraw marketing consent.

Once the applicable retention period has expired, your data will be securely deleted or anonymised so it can no longer be associated with you.

8 Your Rights Regarding Personal Data

Under Malaysia's PDPA and sound data protection principles, you have the following rights regarding the personal data we hold about you:

• Right of Access

  You have the right to request a copy of the personal data we hold about you. We will process this request within 14 working days.

• Right to Rectification

  If your data is inaccurate or incomplete, you have the right to request that we correct it. You can also update much of your information directly through your account settings.

• Right to Erasure

  Under certain circumstances, you have the right to request that we delete your personal data. Please note that some data may need to be retained for legal compliance.

• Right to Data Portability

  You may request the data you have provided to us in a machine-readable format for transfer to another service where applicable.

• Right to Object to Processing

  You may object to the processing of your data for direct marketing purposes at any time. Your objection will be enforced within 5 working days.

9 Children's Privacy and Age Restrictions

The TaxiToto platform is for individuals aged 18 and above only. We do not knowingly collect or process personal data from individuals under the age of 18. If you believe we may have personal data of an underage individual without your knowledge, please contact us immediately and we will take steps to delete that data.

All users are required to verify their age during registration and throughout the KYC process. Accounts confirmed to belong to underage individuals will be terminated immediately and all available funds will be returned to the relevant guardian or parent.

10 How to Contact Us About Privacy

If you have any questions, concerns, or wish to exercise your privacy rights, you may contact our Data Protection Officer (DPO) through the following channels:

• Privacy email: [email protected]
• General support email: [email protected]
• Via live chat on the TaxiToto platform (login required)

We will respond to all privacy-related enquiries within 5 working days and will resolve formal requests within 14 working days. If you are not satisfied with our response, you have the right to lodge a complaint with the Malaysian Communications and Multimedia Commission (MCMC) or the relevant regulatory body.