Privacy Policy

Who We Are

toto21 is an online casino and sports betting platform operating at toto21.im, offering casino games, live dealer tables, slot titles, and a sportsbook to registered adult players. The Company operates under an international gaming licence framework and is subject to the data protection obligations imposed by its licensing authority.

For the purposes of this Privacy Policy, toto21 acts as the data controller in respect of the personal data of its registered players. As data controller, toto21 determines the purposes and means by which personal data is processed. Where toto21 engages third-party service providers who process personal data on its behalf, those providers act as data processors and are subject to contractual data processing agreements consistent with this policy.

Questions, requests, and complaints relating to this Privacy Policy should be directed to toto21's data protection contact at [email protected].

Personal Data We Collect

toto21 collects the following categories of personal data from registered players and platform visitors:

We do not intentionally collect sensitive personal data such as racial or ethnic origin, religious beliefs, health data, or political opinions. If any such data is provided incidentally, it will not be processed for any purpose and will be deleted.

How We Collect Your Data

toto21 collects personal data through the following mechanisms:

• Direct collection: Data provided by you when completing the registration form, uploading KYC documents, making deposit or withdrawal requests, contacting support, or updating your Account profile.
• Automated collection: Technical data collected automatically when you access the toto21 platform, including via browser cookies, server logs, and session tracking technologies.
• Third-party providers: Data received from payment processors (JazzCash, Easypaisa, bank partners, Skrill) in connection with transaction processing, and from identity verification service providers in connection with KYC completion.
• Publicly available sources: In limited circumstances, toto21 may verify identity or address information against publicly available records for fraud prevention or AML compliance purposes.

Legal Basis for Processing

toto21 processes personal data on one or more of the following legal bases:

• Contract performance: Processing necessary to provide the services you have requested by registering a toto21 Account, including account management, game delivery, payment processing, and withdrawal handling.
• Legal obligation: Processing required to comply with applicable AML regulations, KYC requirements, tax reporting obligations, and directions from regulatory or law enforcement authorities.
• Legitimate interests: Processing necessary for fraud prevention, platform security, responsible gaming compliance, and improvement of toto21's products and services, where such interests are not overridden by your rights and interests.
• Consent: Where toto21 seeks your consent for specific processing activities (such as marketing communications), we will do so explicitly and separately. You may withdraw consent at any time by contacting us.

How We Use Your Personal Data

toto21 uses collected personal data for the following purposes:

• Creating and managing your toto21 Account and verifying your identity;
• Processing deposits and withdrawals via JazzCash, Easypaisa, and other accepted payment methods in PKR and other accepted currencies;
• Delivering casino games, live dealer tables, sportsbook services, and promotional offers;
• Conducting KYC verification and ongoing AML monitoring as required by our licensing obligations;
• Administering our responsible gaming programme, including applying deposit limits, loss limits, and self-exclusion measures;
• Detecting and preventing fraud, account takeovers, money laundering, and other prohibited conduct;
• Providing customer support and resolving complaints;
• Sending transactional communications (deposit confirmations, withdrawal notifications, security alerts) and, where you have consented, promotional communications;
• Analysing platform usage to improve product features, game offerings, and user experience;
• Complying with applicable laws, regulations, and the directions of competent authorities.

Data Sharing & Third-Party Disclosure

toto21 does not sell, rent, or trade your personal data to third parties. We share personal data only in the following circumstances and with the following categories of recipients:

• Payment processors: JazzCash, Easypaisa, Skrill, bank transfer processors, and cryptocurrency payment facilitators receive the minimum personal and financial data necessary to process your transactions.
• Identity verification providers: Third-party KYC and AML service providers receive identity documents and personal data necessary to complete verification checks on our behalf, under data processing agreements.
• Game providers: Software providers whose games are hosted on the toto21 platform may receive anonymised or pseudonymised technical data (session IDs, RNG seeds) necessary to deliver game functionality. They do not receive your name, payment details, or contact information.
• Platform infrastructure providers: Cloud hosting, CDN, and technical infrastructure providers process technical data as data processors under appropriate data processing agreements.
• Regulatory and law enforcement authorities: toto21 will disclose personal data to competent authorities where required by applicable law, court order, or regulatory direction, including for AML and counter-terrorism financing purposes.
• Professional advisors: Lawyers, auditors, and accountants may access personal data on a need-to-know basis in connection with their professional services to toto21.

All third-party data processors engaged by toto21 are subject to contractual obligations consistent with this Privacy Policy and applicable data protection law.

International Data Transfers

toto21 operates on an international basis, and your personal data may be transferred to and processed in countries other than Pakistan. Where such transfers occur, toto21 ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that required by our licensing jurisdiction, including through the use of contractual data transfer mechanisms and security standards.

By registering a toto21 Account, you acknowledge and consent to the transfer of your personal data as described in this section. If you have concerns about international data transfers, please contact us at [email protected].

Data Retention

toto21 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account and identity data: Retained for the duration of your toto21 Account plus a minimum of 5 years following Account closure, in compliance with AML regulatory obligations.
• Financial transaction records: Retained for a minimum of 5 years following each transaction, in compliance with applicable financial record-keeping requirements.
• KYC documents: Retained for the duration of your Account plus a minimum of 5 years post-closure.
• Gaming session logs: Retained for a minimum of 3 years following each session for dispute resolution and regulatory compliance purposes.
• Support communications: Retained for 2 years following resolution of the relevant matter.
• Technical and analytics data: Retained in anonymised or aggregated form indefinitely; identifiable technical data is deleted after 13 months.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised.

Cookies & Tracking Technologies

toto21 uses the following categories of cookies and similar technologies on the platform:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. These cannot be disabled without rendering the platform non-functional.
• Functional cookies: Remember your preferences (language, display settings) to personalise your experience. These persist across sessions until cleared.
• Analytics cookies: Collect anonymised usage data to help toto21 understand how players interact with the platform and where improvements should be made. No personally identifiable data is included in analytics reports.
• Security cookies: Used for fraud detection, bot prevention, and account security monitoring.

toto21 does not use third-party advertising or retargeting cookies. You may control cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to your toto21 Account.

Your Data Protection Rights

As a toto21 Account holder, you have the following rights in respect of your personal data, subject to applicable law and our legal obligations:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data where there is no legitimate basis for continued processing. Note that regulatory retention obligations may prevent full erasure in some cases.
• Right to Restriction: You may request that we restrict processing of your personal data in certain circumstances.
• Right to Data Portability: You may request a machine-readable copy of personal data you have provided to toto21 for the purpose of transferring it to another service provider.
• Right to Object: You may object to processing of your personal data where we rely on legitimate interests as the legal basis, or where processing is for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, submit a written request to [email protected] from your registered email address. We will respond within 30 days and may request identity verification before processing your request.

Data Security Measures

toto21 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, or disclosure:

• All data in transit is protected by TLS 1.2 or higher encryption;
• All data at rest is encrypted using industry-standard encryption algorithms;
• Passwords are stored exclusively as salted cryptographic hashes and are never accessible in plain text, even to toto21 staff;
• Access to personal data systems is restricted to authorised personnel on a need-to-know basis, with full audit logging;
• Two-factor authentication is required for all internal toto21 staff accessing production systems containing personal data;
• Regular independent penetration testing and security audits are conducted on toto21's infrastructure;
• A documented data breach response procedure is in place, including notification protocols for affected players and regulators where required.

While toto21 takes all reasonable steps to protect your personal data, no internet transmission or electronic storage system is completely secure. You are responsible for maintaining the security of your own Account credentials and for notifying toto21 promptly if you suspect unauthorised access.

Children's Privacy

The toto21 platform is strictly for adults aged 18 years and over. We do not knowingly collect personal data from any person under the age of 18. Age verification is conducted at registration and may be repeated at any time.

If we become aware that personal data has been collected from a person under 18, we will immediately close the associated Account, void all transactions and balances associated with it, securely delete the personal data, and report the incident as required by applicable regulations. If you believe a minor has registered a toto21 Account, please notify us immediately at [email protected].

Changes to This Privacy Policy

toto21 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform functionality. Where changes are material, we will notify registered Account holders via email or prominent on-platform notification prior to the changes taking effect.

The "Last updated" date at the top of this document reflects the date of the most recent revision. We encourage you to review this Privacy Policy periodically. Your continued use of the toto21 platform following notification of any updates constitutes your acknowledgement of the revised policy.

Contact & Data Protection Enquiries

For all privacy-related enquiries, data subject rights requests, or complaints relating to toto21's data processing activities, please contact us:

• Email: [email protected]
• Subject line: Please include "Privacy Request" or "Data Protection" in the subject line of your email to ensure prompt routing to the appropriate team.
• Response time: We will acknowledge receipt of your request within 5 business days and will provide a substantive response within 30 calendar days.

If you are dissatisfied with toto21's response to a privacy complaint, you may escalate the matter to the data protection supervisory authority of toto21's licensing jurisdiction or to any other competent supervisory authority with jurisdiction over your complaint.