toto20 Privacy Policy

1. Introduction

toto20 is an internationally licensed online gaming platform serving Pakistani players. We operate casino games, live dealer tables, cricket and sports betting, slot titles, and fishing arcade games — all denominated in Pakistani Rupees (PKR). As part of delivering these services, toto20 necessarily collects and processes certain personal data relating to the individuals who use the platform.

We are committed to handling your personal data responsibly and in full compliance with applicable data protection standards, including the principles embedded in our international gaming licence. This policy applies to all personal data collected through the toto20 website, mobile-optimised platform, customer support channels, and any related communications.

This policy should be read as a whole. Isolated sections may not convey the full picture of how toto20 manages your data. If you have questions about any part of this policy, our support team is available 24/7 via live chat and will be glad to assist.

2. Data Controller

toto20 acts as the data controller in respect of all personal data collected through the platform. As data controller, toto20 determines the purposes for which personal data is processed and the means by which that processing is carried out. toto20 is responsible for ensuring that personal data is processed lawfully, fairly, and in a transparent manner consistent with this policy.

Where toto20 engages third-party service providers to process personal data on its behalf — such as payment processors, KYC verification providers, or cloud infrastructure partners — those providers act as data processors and are bound by contractual obligations that require them to process data only on toto20's documented instructions, maintain appropriate security measures, and not retain data beyond the period necessary to fulfil the contracted service.

3. Data We Collect

toto20 collects personal data through several channels, including account registration, KYC verification, platform usage, payment transactions, customer support interactions, and cookies. The categories of personal data we collect are set out in the table below:

Category	Examples	Collection Method
Identity Data	Full legal name, date of birth, CNIC number, selfie photograph	Registration form, KYC verification portal
Contact Data	Mobile number (JazzCash / EasyPaisa registered), email address, city of residence (e.g. Karachi, Lahore, Islamabad, Faisalabad)	Registration form, account settings
Financial Data	Deposit and withdrawal transaction records, payment method identifiers, PKR amounts, transaction timestamps	Cashier, payment processor integrations
Technical Data	IP address, device type, browser type and version, operating system, session duration, login timestamps	Automatically via platform logs and cookies
Usage Data	Games played, bet amounts, wagering history, bonus usage, sports markets accessed	Platform activity tracking
Communications Data	Live chat transcripts, support ticket content, email correspondence	Customer support interactions
Marketing Preferences	Opt-in/opt-out status for email, SMS, and push notifications	Account notification settings

toto20 does not collect sensitive special-category personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond CNIC facial image for identity verification), or health data, except where expressly required for responsible gaming assessments and only with your knowledge.

4. How We Use Your Data

toto20 processes your personal data for the following specific purposes:

• Account Creation and Management: To register your toto20 account, authenticate your identity at login, and maintain your account profile and preferences.
• KYC and Age Verification: To verify that you meet the minimum age requirement of 21 years and to confirm your identity in compliance with our licensing obligations and anti-money laundering requirements.
• Transaction Processing: To facilitate PKR deposits via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, 1LINK, GrabPay, and Retail Cash OTC, and to process withdrawal requests to your verified payment method.
• Platform Delivery: To provide access to casino games, live dealer tables, cricket and sports betting markets, slot titles, and fishing arcade games, and to ensure the technical operation of the platform.
• Fraud Prevention and Security: To detect and investigate suspicious account activity, fraudulent transactions, multi-accounting, and prohibited conduct as defined in our Terms & Conditions.
• Regulatory Compliance: To fulfil obligations imposed by our international gaming licence, including anti-money laundering (AML) reporting, responsible gaming monitoring, and cooperation with competent regulatory authorities.
• Customer Support: To respond to your queries, complaints, and requests submitted via live chat or email, and to maintain records of support interactions for quality assurance purposes.
• Responsible Gaming: To monitor your gaming patterns, identify indicators of potentially problematic gambling behaviour, and where appropriate, take proactive responsible gaming interventions as required by our licence.
• Marketing Communications: To send you personalised promotional offers, bonus notifications, and platform updates — but only where you have given explicit consent or where legitimate interest applies within the bounds of applicable law.
• Platform Improvement: To analyse aggregate, anonymised usage data to improve game offerings, platform performance, user experience, and promotional strategy.

5. Legal Basis for Processing

toto20 processes your personal data on one or more of the following legal bases, depending on the specific purpose of processing:

• Contract Performance: Processing is necessary to fulfil toto20's obligations to you under our Terms & Conditions — for example, processing deposits and withdrawals, providing access to games, and managing your account.
• Legal Obligation: Processing is required for toto20 to comply with applicable law and our international gaming licence conditions — for example, KYC identity verification, AML transaction monitoring, and age verification.
• Legitimate Interests: Processing is necessary for toto20's legitimate business interests, provided those interests are not overridden by your privacy rights — for example, fraud detection, platform security, and service improvement using anonymised analytics.
• Consent: Where toto20 relies on consent as the legal basis — particularly for direct marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Data Sharing

toto20 does not sell, rent, or trade your personal data to any third party for commercial marketing purposes. We may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to contractual data protection obligations:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, 1LINK, GrabPay, and our retail cash OTC partner, to facilitate PKR deposits and withdrawals.
• KYC and Identity Verification Providers: Third-party identity verification services that assist toto20 in confirming the identity and age of account holders in compliance with our licensing obligations.
• Game Content Providers: Software providers who supply the casino games, live dealer tables, slot titles, and fishing arcade titles available on toto20. These providers receive only the minimum data necessary for game session management and fairness auditing.
• Cloud Infrastructure and Hosting Providers: Secure, certified hosting and server infrastructure partners on whose systems toto20 platform data is stored and processed.
• Regulatory and Law Enforcement Authorities: Where toto20 is legally required to disclose personal data to a competent regulatory authority, law enforcement agency, or court of competent jurisdiction, we will comply with that lawful requirement. toto20 will notify the affected player where permitted by law.
• Fraud Prevention and AML Networks: Industry-level fraud prevention and anti-money laundering databases where sharing is required under our licence conditions or applicable financial crime prevention obligations.

All third-party data processors engaged by toto20 are subject to written data processing agreements that impose data protection standards consistent with this policy. toto20 conducts due diligence on third-party processors before engagement and monitors their compliance on an ongoing basis.

7. Data Retention

toto20 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and our licensing obligations. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your active toto20 account plus a minimum of 5 years following account closure, in accordance with AML and gaming licence record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of 5 years from the date of each transaction, in compliance with financial record-keeping obligations under our international gaming licence.
• Customer Support Records: Live chat transcripts and support correspondence are retained for up to 3 years from the date of the interaction, to support dispute resolution and quality improvement.
• Technical and Usage Data: Server logs and session data are typically retained for 12 months before being deleted or anonymised for aggregate analytics purposes.
• Marketing Preference Records: Opt-in and opt-out records are retained for the life of your toto20 account and for 2 years following account closure, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Where anonymised aggregate data is retained for analytics purposes, it can no longer be used to identify any individual.

8. Security Measures

toto20 implements a layered technical and organisational security framework to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the toto20 platform.
• Encryption at rest for all personal data stored on toto20 servers.
• Role-based access controls limiting internal access to personal data to staff who require it for legitimate operational purposes.
• Multi-factor authentication (MFA) for all internal toto20 administrative systems.
• Regular penetration testing and vulnerability assessments conducted by independent security specialists.
• Comprehensive audit logging of all access to personal data by internal staff and system processes.
• A documented incident response plan governing the detection, containment, and notification of any personal data breach.

In the event of a personal data breach that poses a risk to your rights and freedoms, toto20 will notify you and the relevant supervisory authority within the timeframes required by applicable law and our licensing obligations. You will be informed of the nature of the breach, the data affected, and the remedial steps toto20 has taken or is taking.

Please note that no online platform can guarantee absolute security. You also have a role to play in keeping your toto20 account secure — use a strong, unique password and never share your login credentials with anyone. Contact toto20 support immediately via live chat if you suspect unauthorised access to your account.

9. Cookies and Tracking Technologies

toto20 uses cookies and similar tracking technologies (including local storage and session tokens) to operate and improve the platform. The categories of cookies we use are as follows:

• Strictly Necessary Cookies: Essential for the platform to function correctly, including session authentication, maintaining your login state, and enabling secure transactions. These cookies cannot be disabled without impairing platform functionality.
• Functional Cookies: Used to remember your preferences, such as language settings and display preferences, so you do not need to reconfigure them on each visit.
• Analytics Cookies: Used to collect anonymised, aggregate data about how users interact with the toto20 platform. This data helps us identify areas for improvement and optimise the user experience. No individual user is identifiable from analytics data.
• Security Cookies: Used to detect and prevent fraudulent activity, bot access, and other security threats to the platform and to individual accounts.

toto20 does not use advertising cookies or cross-site tracking cookies that follow your activity on third-party websites. You can control and delete cookies through your browser settings. Disabling strictly necessary cookies may affect your ability to use the toto20 platform. For detailed instructions on managing cookies in your specific browser, consult your browser's help documentation.

10. Your Data Rights

Subject to applicable law and the conditions of our international gaming licence, you have the following rights in relation to your personal data held by toto20:

• Right of Access: You may request a copy of all personal data toto20 holds about you, along with information about how it is processed. This is commonly referred to as a Subject Access Request (SAR).
• Right to Rectification: If any personal data held by toto20 is inaccurate or incomplete, you have the right to request correction. You can update many personal details directly from within your account settings.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where processing was unlawful. This right is subject to legal and regulatory retention obligations — toto20 cannot erase data it is legally required to retain.
• Right to Restrict Processing: You may request that toto20 restrict the processing of your personal data in certain circumstances, for example while a rectification request is under review.
• Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you may request that toto20 provide your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including profiling for responsible gaming monitoring purposes, though toto20 may continue processing where compelling legitimate grounds exist.
• Right to Withdraw Consent: Where toto20 processes your data on the basis of consent, you may withdraw that consent at any time without detriment, though withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

To exercise any of these rights, contact toto20 support via live chat or email at [email protected]. We will respond to all data rights requests within 30 days. Complex requests may require up to 60 days; we will notify you if an extension is needed.

11. Marketing Communications

toto20 may send you marketing communications about bonuses, promotions, new game launches, PSL cricket betting specials, and other platform news. Marketing communications are sent only where you have explicitly opted in during registration or subsequently via your account notification settings.

You can opt out of all toto20 marketing communications at any time by:

• Updating your notification preferences in your toto20 account settings.
• Clicking the unsubscribe link included at the bottom of every toto20 marketing email.
• Contacting toto20 support via live chat and requesting removal from all marketing lists.

Opting out of marketing communications does not affect transactional communications — toto20 will continue to send you account-related notifications such as deposit confirmations, withdrawal updates, KYC verification requests, and security alerts regardless of your marketing preferences, as these are necessary for the operation of your account.

12. Minors and Under-21 Policy

toto20 operates a strict minimum age policy of 21 years. The platform is not directed at or intended for use by individuals under the age of 21. toto20 does not knowingly collect personal data from any person under the age of 21.

If toto20 becomes aware that personal data has been collected from an individual who is under the minimum age, the affected account will be immediately closed, all deposits returned, all winnings forfeited, and all associated personal data deleted from our systems as promptly as permitted by applicable law and regulatory requirements. If you believe a minor may have accessed or registered on toto20, please contact our support team immediately via live chat.

13. International Data Transfers

As an internationally licensed platform, toto20 may transfer your personal data to, and store it on, servers located in countries outside Pakistan. Where personal data is transferred internationally, toto20 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection principles.

Safeguards used for international transfers include contractual clauses that impose data protection obligations on recipient parties, engagement of processors that hold internationally recognised data security certifications, and technical measures such as encryption in transit and at rest. If you have specific questions about international data transfers affecting your personal data, please contact our support team.

14. Changes to This Privacy Policy

toto20 may update this Privacy Policy from time to time to reflect changes in our data processing practices, technological developments, changes in applicable law, or updates to our licensing obligations. The effective date at the top of this policy will be updated whenever a new version is published.

Where changes are material — meaning they significantly affect your rights or how your data is processed — toto20 will notify you via platform notification or email to your registered address before the changes take effect. We encourage you to review this policy periodically to stay informed about how toto20 protects your privacy. Your continued use of the platform following notification of material changes constitutes your acceptance of the revised policy.

15. Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way toto20 processes your personal data, please contact us through the following channels:

• Live Chat: Available 24/7 directly within the toto20 platform. This is the fastest channel for privacy-related queries.
• Email: [email protected] — please allow up to 24 hours for email responses. For data rights requests, please include "Privacy Request" in the subject line along with your registered username.

If you are not satisfied with toto20's response to a privacy concern, you have the right to escalate the matter to the data protection supervisory authority in the jurisdiction where toto20 holds its international gaming licence. Details of the applicable authority are available from toto20 support upon request.

toto20 takes all privacy complaints seriously and will investigate each complaint thoroughly and promptly. We aim to resolve all privacy-related complaints within 30 days of receipt and will keep you informed of progress throughout the process.