toto21 Privacy Policy

1. Introduction

1.1 This Privacy Policy applies to all personal data collected by toto21 through toto21.asia, our mobile-optimized platform, customer support channels, and any other services we operate in connection with the toto21 brand.

1.2 toto21 acts as the Personal Information Controller (PIC) in respect of the personal data you provide when registering for a toto21 account, using our services, or communicating with our support team.

1.3 We encourage you to read this Privacy Policy carefully alongside our Terms & Conditions and Responsible Gaming Policy, which together govern your use of the toto21 platform.

1.4 If you have questions about this Privacy Policy or how toto21 handles your personal data, please contact our Data Protection Officer using the details provided in Section 14 of this document.

2. Personal Data We Collect

2.1 toto21 collects the following categories of personal data from players and prospective players:

2.1 Identity & Contact Data

• Full legal name as it appears on a government-issued ID;
• Date of birth (to verify the 21+ age requirement);
• Residential address, including city, province, and postal code;
• Email address and mobile phone number;
• Government-issued identification documents (e.g., Philippine passport, SSS ID, PhilSys National ID, driver's licence, UMID).

2.2 Financial Data

• GCash or PayMaya/Maya account details (mobile number associated with the e-wallet);
• Philippine bank account details for bank transfer transactions (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank);
• Debit card details (card number, expiry date — stored in tokenized form only);
• Transaction history, including deposit amounts, withdrawal requests, and account balances in Philippine Peso (PHP / ₱).

2.3 Gaming & Activity Data

• Game history, wager amounts, wins, and losses;
• Bonus and promotion usage history;
• Session duration, login timestamps, and toto21 login activity logs;
• Responsible gaming settings, including deposit limits and self-exclusion status.

2.4 Technical & Device Data

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Cookies and session identifiers (see Section 7);
• Platform interaction data, including pages visited and features used.

2.5 Communications Data

• Records of communications with toto21 customer support, including chat transcripts and email correspondence;
• Survey responses and feedback submitted through the platform.

3 . How We Collect Your Data

3.1 toto21 collects personal data through the following means:

• Direct collection: Information you provide when registering a toto21 account, completing KYC verification, making deposits or withdrawals, contacting customer support, or participating in promotions;
• Automated collection: Technical and device data collected automatically when you access toto21.asia, including through cookies, log files, and analytics tools;
• Third-party sources: Identity verification and fraud prevention service providers, payment processors (GCash, PayMaya/Maya, Philippine banks), and PAGCOR regulatory databases where applicable;
• Publicly available sources: Information from public records or government databases used to verify your identity or comply with anti-money laundering obligations.

4. How We Use Your Personal Data

4.1 toto21 uses your personal data for the following purposes:

4.2 toto21 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise required by Philippine law.

5. Legal Basis for Processing

5.1 toto21 processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to perform our obligations under the toto21 Terms & Conditions, including account management, payment processing, and game provision;
• Legal obligation: Processing required to comply with Philippine law, including PAGCOR regulations, the Anti-Money Laundering Act (RA 9160 as amended), and the Data Privacy Act of 2012;
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming monitoring, and improving our services, where such interests are not overridden by your rights;
• Consent: Processing for marketing communications and non-essential cookies, where you have provided explicit, informed consent that may be withdrawn at any time.

6. Data Sharing & Disclosure

6.1 toto21 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients only to the extent necessary for the stated purpose:

• Payment processors: GCash, PayMaya/Maya, and Philippine banking partners (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) to process your financial transactions;
• KYC and identity verification providers: Accredited third-party services used to verify your identity and age in compliance with PAGCOR requirements;
• Fraud prevention and AML services: Specialist providers that help toto21 detect and prevent fraudulent activity and money laundering;
• IT and platform service providers: Cloud hosting, data storage, and technical infrastructure providers operating under strict data processing agreements;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government bodies, where disclosure is required by law or regulatory obligation;
• Legal and professional advisers: Lawyers, auditors, and compliance consultants bound by professional confidentiality obligations.

6.2 All third-party service providers engaged by toto21 are required to process your personal data only on our documented instructions and in compliance with the Data Privacy Act of 2012. toto21 maintains data processing agreements with all such providers.

6.3 In the event of a merger, acquisition, or sale of toto21's business assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. You will be notified of any such transfer in advance.

7. Cookies & Tracking Technologies

7.1 toto21.asia uses cookies and similar tracking technologies to enhance your experience on the platform. A cookie is a small text file placed on your device when you visit our website.

Types of Cookies We Use

• Strictly necessary cookies: Essential for the operation of toto21.asia, including maintaining your toto21 login session, remembering your language preference, and enabling secure account access. These cannot be disabled.
• Performance and analytics cookies: Used to collect aggregated, anonymized data about how players use toto21.asia, helping us identify areas for improvement. No personally identifiable information is collected through these cookies.
• Functional cookies: Allow toto21 to remember your preferences, such as display settings and responsible gaming limits you have set, to provide a more personalized experience.
• Marketing cookies: Used only with your explicit consent to deliver relevant promotional content about toto21 games and offers. You may opt out of marketing cookies at any time.

7.2 You can manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of toto21.asia. For detailed instructions on managing cookies in your browser, refer to your browser's help documentation.

7.3 toto21 does not use cookies to track your activity on third-party websites unrelated to our platform.

8. Data Retention

8.1 toto21 retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law and regulatory obligations.

8.2 The following general retention periods apply:

• Account and identity data: Retained for the duration of your toto21 account and for a minimum of five (5) years following account closure, in compliance with PAGCOR and AMLC record-keeping requirements;
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act;
• Gaming activity data: Retained for a minimum of three (3) years from the date of the relevant gaming session;
• Customer support communications: Retained for two (2) years from the date of the last communication;
• Marketing consent records: Retained until you withdraw consent, plus one (1) year thereafter for compliance documentation purposes.

8.3 Upon expiry of the applicable retention period, toto21 will securely delete or anonymize your personal data in accordance with our data disposal procedures.

9. Data Security

9.1 toto21 implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

• Transport Layer Security (TLS) encryption for all data transmitted between your device and toto21.asia;
• Encryption at rest for sensitive personal and financial data stored on toto21 servers;
• Strict access controls ensuring that only authorized toto21 personnel with a legitimate need can access personal data;
• Regular security assessments, penetration testing, and vulnerability scanning of the toto21 platform;
• Multi-factor authentication options for toto21 account access;
• Staff training on data protection obligations and information security best practices.

9.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, toto21 will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with the Data Privacy Act of 2012.

9.3 While toto21 takes all reasonable steps to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your toto21 login credentials and for notifying us immediately if you suspect unauthorized access to your account.

10. Your Data Privacy Rights

10.1 Under the Data Privacy Act of 2012 (RA 10173), you have the following rights with respect to your personal data held by toto21:

• Right to be informed: The right to know what personal data toto21 collects about you and how it is used — as described in this Privacy Policy;
• Right of access: The right to request a copy of the personal data toto21 holds about you;
• Right to rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to toto21's legal retention obligations;
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests;
• Right to data portability: The right to receive your personal data in a structured, commonly used, and machine-readable format;
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe toto21 has violated your data privacy rights.

10.2 To exercise any of the above rights, please contact toto21's Data Protection Officer using the contact details in Section 14. We will respond to all verified data subject requests within thirty (30) days of receipt, or within such extended period as permitted by law where the request is complex.

10.3 toto21 may need to verify your identity before processing a data subject request to ensure that personal data is not disclosed to unauthorized parties.

11. Children's Privacy

11.1 toto21 is strictly an adult platform. We do not knowingly collect personal data from individuals under the age of twenty-one (21). The 21+ age requirement is enforced at registration through our KYC verification process.

11.2 If toto21 becomes aware that personal data has been collected from a person under 21 years of age, we will immediately suspend the relevant account, delete the associated personal data, and report the matter to the appropriate authorities where required.

11.3 If you are a parent or guardian and believe that a minor has registered a toto21 account, please contact our support team immediately so that we can take prompt action.

12. International Data Transfers

12.1 toto21 primarily stores and processes personal data within the Philippines. Where it is necessary to transfer personal data to service providers or infrastructure located outside the Philippines, toto21 will ensure that such transfers are made in compliance with the Data Privacy Act of 2012 and its Implementing Rules and Regulations.

12.2 International transfers of personal data will only be made to countries or organizations that provide an adequate level of data protection, or where appropriate safeguards are in place, such as contractual clauses approved by the National Privacy Commission.

12.3 toto21 will not transfer your personal data to jurisdictions that do not provide adequate data protection without your explicit consent, except where required by Philippine law.

13. Changes to This Privacy Policy

13.1 toto21 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The "Last Updated" date at the top of this page will be revised accordingly.

13.2 Where changes to this Privacy Policy are material, toto21 will notify registered players via email or an in-platform notification prior to the changes taking effect. For minor updates, the revised Policy will be published on this page without separate notification.

13.3 Your continued use of the toto21 platform following the effective date of any amendment constitutes your acknowledgment of the updated Privacy Policy. If you do not agree to the revised Policy, you should cease using the platform and may request account closure.

13.4 The most current version of this Privacy Policy is always available at toto21.asia/privacy-policy.

14. Contact & Data Protection Officer

14.1 toto21 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. If you have any questions, concerns, or requests relating to your personal data or this Privacy Policy, please contact our DPO.

14.2 You may reach the toto21 Data Protection Officer by email at: privacy@toto21.asia

14.3 For general customer support inquiries, including account-related matters, please contact: support@toto21.asia

14.4 toto21 aims to respond to all privacy-related inquiries within fifteen (15) business days. For formal data subject requests, the response period is thirty (30) days from receipt of a verified request, as provided under the Data Privacy Act of 2012.

14.5 If you are not satisfied with toto21's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines, which is the competent supervisory authority for data protection matters in the Philippines.