toto33 Privacy Policy

Data Controller Information

1.1 The data controller responsible for personal data processed via the toto33 Platform (toto33.co) is the toto33 operating entity. For privacy-related enquiries, you may contact the toto33 Data Protection team via the contact details set out in Section 13 of this Policy.

1.2 toto33 is committed to processing personal data lawfully, fairly, and transparently in accordance with applicable data protection principles and obligations.

Data We Collect

2.1 toto33 collects personal data in the following categories:

2.2 toto33 does not intentionally collect special category data (e.g., health, religious, or political information). If you voluntarily disclose such information in a support interaction, it will be used solely to address your query and will not be retained beyond that purpose.

How We Use Your Data

3.1 toto33 uses collected personal data for the following purposes:

• Account administration: creating and managing your toto33 account, verifying your identity and age (18+), and maintaining your account security.
• Service delivery: processing deposits and withdrawals in PKR, crediting winnings, calculating and awarding bonuses, and providing access to all toto33 Platform features.
• Fraud prevention and security: detecting and investigating suspicious activity, unauthorised access, bonus abuse, and financial crime including money laundering.
• Legal and regulatory compliance: meeting anti-money laundering (AML) obligations, responding to lawful requests from authorities, and maintaining records as required by applicable law.
• Responsible gaming: monitoring gaming patterns to identify players at risk of problem gambling and implementing responsible gaming interventions including self-exclusion enforcement.
• Customer support: responding to queries, resolving disputes, and maintaining communication records.
• Platform improvement: analysing usage data to improve game selection, payment flows, and user experience on toto33.
• Direct marketing: sending promotional communications about toto33 bonuses, new games, and offers — subject to your communication preferences and applicable opt-out rights.

Legal Bases for Processing

4.1 toto33 processes personal data under the following legal bases:

• Contractual necessity: processing required to perform the contract between toto33 and the player (account operation, payment processing, game access).
• Legal obligation: processing required to comply with applicable law, including AML obligations and age verification requirements.
• Legitimate interests: fraud prevention, platform security, and service improvement — where these interests do not override the player's fundamental rights.
• Consent: direct marketing communications, where we rely on your opt-in consent. You may withdraw consent at any time by contacting toto33 support.

Data Sharing and Disclosure

5.1 toto33 does not sell personal data to third parties. We may share personal data with the following categories of recipient where necessary:

• Payment processors: JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, Visa/Mastercard networks, and other payment service providers, solely for the purpose of processing your deposits and withdrawals in PKR.
• Identity verification providers: third-party KYC and AML service providers used to verify player identity and comply with anti-money laundering obligations.
• Game software providers: casino game studios whose titles are available on the toto33 Platform may receive anonymised or pseudonymised usage data for the purpose of game performance analysis.
• Legal and regulatory authorities: where toto33 is required by law, court order, or competent regulatory authority to disclose personal data.
• IT and hosting service providers: infrastructure and security service providers operating under contractual obligations to maintain data confidentiality and security.

5.2 All third-party data processors engaged by toto33 are contractually required to process personal data only on toto33's instructions, to maintain appropriate security standards, and to comply with applicable data protection obligations.

Cookies and Tracking Technologies

6.1 toto33.co uses cookies and similar tracking technologies to operate and improve the Platform. The categories of cookies used include:

• Strictly necessary cookies: required for account login, session management, and basic Platform functionality. These cannot be disabled without impairing Platform operation.
• Performance cookies: collect anonymised data about how players navigate the Platform, which pages are visited most frequently, and where errors occur. This data is used to improve the toto33 experience.
• Functional cookies: remember your language preference, game settings, and display preferences to personalise your toto33 session.
• Marketing / analytics cookies: used to track the effectiveness of toto33 promotional campaigns and analyse traffic sources. These are deployed only with your consent where required.

6.2 You may manage cookie preferences through your browser settings. Note that disabling certain cookies may affect Platform functionality, including the ability to maintain a logged-in toto33 session.

Data Retention

7.1 toto33 retains personal data for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal obligations. The following general retention periods apply:

• Account and transaction data: retained for a minimum of 5 years following account closure, in compliance with AML record-keeping obligations.
• KYC documents: retained for a minimum of 5 years following account closure or the date of the last transaction, whichever is later.
• Customer support communications: retained for 3 years following the closure of the relevant support case.
• Marketing consent records: retained for the duration of the marketing relationship and 2 years thereafter as evidence of consent.

7.2 Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with toto33's data disposal procedures.

Data Security

8.1 toto33 implements technical and organisational security measures appropriate to the nature of the personal data processed. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and toto33.co
• Encrypted storage of passwords and sensitive account credentials
• Two-factor authentication options for player accounts
• Access controls limiting employee access to personal data on a need-to-know basis
• Regular security audits and penetration testing of the toto33 Platform
• Incident response procedures for data breaches, including notification to affected players where required by applicable law

8.2 Notwithstanding the above, no internet-based platform can guarantee absolute security. Players should also take responsibility for their own account security by using strong passwords and not sharing their toto33 login credentials.

Your Rights as a Data Subject

9.1 Subject to applicable law, toto33 players have the following rights regarding their personal data:

• Right of access: you may request a copy of the personal data toto33 holds about you.
• Right to rectification: you may request correction of inaccurate or incomplete personal data held in your toto33 account.
• Right to erasure: you may request deletion of your personal data, subject to toto33's legal retention obligations (e.g., AML record-keeping requirements may prevent full erasure).
• Right to restrict processing: you may request that toto33 temporarily limit the processing of your personal data in certain circumstances.
• Right to data portability: where processing is based on consent or contractual necessity and carried out by automated means, you may request a machine-readable copy of your personal data.
• Right to object: you may object to processing based on legitimate interests or for direct marketing purposes at any time.
• Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

9.2 To exercise any of the above rights, contact toto33 support via live chat or email as set out in Section 13. toto33 will respond to data subject requests within 30 days. In complex or high-volume cases, this period may be extended by a further 30 days with prior notification.

Children and Underage Players

10.1 toto33 is strictly an 18+ platform. We do not knowingly collect personal data from persons under the age of 18. If toto33 discovers that an account has been registered by a minor, the account will be immediately closed, all associated data will be deleted subject to any applicable legal retention requirements, and any deposited funds will be returned in accordance with applicable law.

10.2 If you are a parent or guardian and believe a minor has registered a toto33 account, please contact toto33 support immediately via live chat.

Third-Party Links and Services

11.1 The toto33 Platform may contain links to third-party websites or services. This Privacy Policy applies solely to toto33.co and does not extend to any third-party websites. toto33 is not responsible for the privacy practices of third-party sites. Players should review the privacy policies of any third-party sites they visit.

Changes to This Privacy Policy

12.1 toto33 may update this Privacy Policy from time to time to reflect changes in our data processing practices, operational requirements, or applicable law. The revised Policy will be published at toto33.co/privacy-policy with an updated effective date.

12.2 Material changes to this Privacy Policy will be communicated to registered players via email or on-site notification where reasonably practicable. Continued use of the toto33 Platform following publication of a revised Policy constitutes acceptance of the updated terms.

Contact and Complaints

13.1 For any questions, requests, or complaints regarding this Privacy Policy or toto33's data processing practices, please contact us:

• Live Chat: Available 24/7 via toto33.co
• Email: [email protected]

13.2 toto33 aims to acknowledge privacy-related enquiries within 5 business days and to resolve them within 30 days. If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.