toto399 Privacy Policy —
How We Collect, Use & Protect Your Data

This Privacy Policy applies to toto399, the online casino and sports betting platform operated at toto399.games (referred to in this document as "toto399", "we", "us", or "our"). toto399 serves registered players across Pakistan with a full-service gaming platform including casino games, sports betting, cockfighting markets, live dealer tables, jackpot slots, and PKR wallet services.

As the operator of toto399.games, we are the data controller responsible for the personal data of registered players and website visitors. This means we determine the purposes and means of processing your personal data as described in this policy.

If you have any questions about how toto399 processes your personal data, or wish to exercise any of your rights described in this policy, please contact our Data Support team at [email protected] with the subject line "Privacy Inquiry".

toto399 collects personal data in several ways — through account registration, through your use of the platform's services, through payment transactions, and through identity verification. The categories of personal data we collect are as follows:

Registration Data

• Email address (required for account creation and communications)
• Account password (stored as a salted cryptographic hash — never in readable form)
• Date of birth (required for age verification — 18+ only)
• Preferred currency (PKR by default for Pakistan players)

Identity Verification (KYC) Data

• Full legal name as on CNIC (Computerised National Identity Card)
• CNIC number and copy of CNIC document
• Selfie photograph for identity matching
• Proof of address where required for enhanced verification

Financial & Transaction Data

• Payment method details (Easypaisa mobile number, JazzCash number, SadaPay number, bank account details for Meezan Bank, HBL, UBL, or USDT TRC20 wallet address)
• Transaction history — deposits and withdrawals in PKR
• Wallet balance history

Gameplay Data

• Game session records — games played, bet amounts in PKR, results, timestamps
• Sports betting history — markets bet on, stake amounts, outcomes
• Cockfighting and other game section activity logs
• Bonus claim and wagering requirement completion records

Technical & Device Data

• IP address at time of login and session activity
• Device type, operating system, and browser version
• Session duration and page interaction logs
• Geolocation data (country-level) for fraud detection

Communications Data

• Content of support conversations via Live Chat or email
• Responsible gaming tool usage and self-exclusion requests
• Promotional communication preferences

toto399 uses the personal data described in Section 2 for the following specific purposes:

toto399 does not use personal data for automated decision-making that produces legally significant effects without human review, with the exception of automated fraud detection triggers which are reviewed by a human compliance officer before any account action is taken.

toto399 processes personal data only where a valid legal basis exists. The legal bases we rely on are:

• Contract Performance: Processing necessary to provide the toto399 platform services you have registered for — including account management, game access, and payment processing.
• Legal Obligation: Processing required to comply with applicable laws and regulations — including age verification (18+), KYC/AML obligations, and responsible gaming requirements.
• Legitimate Interests: Processing necessary for toto399's legitimate interests in security, fraud prevention, platform improvement, and responsible gaming monitoring — provided these interests are not overridden by your interests or rights.
• Consent: Processing for optional purposes — such as receiving promotional emails — where you have given explicit, informed consent. You may withdraw consent for optional communications at any time by contacting [email protected].

toto399 processes all player transactions in Pakistani Rupees (PKR). Payment methods available to Pakistan players — including Easypaisa, JazzCash, SadaPay, Raast, Meezan Bank Transfer, HBL, UBL, and USDT TRC20 — require the storage and processing of certain payment identifiers (mobile numbers, bank account references, or wallet addresses) to facilitate deposits and withdrawals.

toto399 operates Know Your Customer (KYC) verification processes as part of our Anti-Money Laundering (AML) compliance obligations. KYC data — including CNIC copies and selfie photographs — is used exclusively for identity verification and fraud prevention. This data is stored securely with access restricted to authorised compliance personnel only.

toto399 may be required to report certain transaction activity to relevant authorities where mandated by applicable law. In such cases, we will disclose only the minimum required information and, where permitted by law, we will notify the affected account holder.

toto399 does not sell, rent, or otherwise commercialise your personal data to third parties. We share personal data only in the following limited circumstances:

• Payment Processors: Your payment method details are shared with the relevant payment network (Easypaisa, JazzCash, SadaPay, Raast, banking partners) solely to process your deposit or withdrawal transaction. These providers process data under their own privacy policies and security standards.
• Game Studios: Game providers (such as Pragmatic Play, Microgaming, NetEnt) receive a player session token to load their games within toto399. This token does not include your name, CNIC, or payment data — only a session identifier.
• KYC Verification Providers: Where toto399 uses a third-party identity verification service to assist with CNIC verification, your KYC documents are shared with that provider under a data processing agreement that restricts their use to verification purposes only.
• Fraud Detection Services: Anonymised or pseudonymised device and session data may be shared with fraud prevention services to detect and prevent account abuse.
• Legal and Regulatory Authorities: toto399 will disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by applicable law or valid legal process.
• Business Transfers: If toto399 undergoes a merger, acquisition, or sale of assets, player data may be transferred to the successor entity — subject to the same privacy protections described in this policy.

toto399 uses cookies and similar tracking technologies to operate the platform, maintain your login session, and improve platform performance. The categories of cookies used on toto399.games are:

• Strictly Necessary Cookies: Essential for core platform functionality — including maintaining your authenticated login session, remembering your language preference, and enabling the game loading mechanism. These cookies cannot be disabled without preventing toto399 from functioning correctly.
• Functional Cookies: Remember your preferences within the platform — such as game filters, display settings, and notification preferences — to personalise your experience without requiring you to reset preferences each visit.
• Performance & Analytics Cookies: Collect anonymised data on how players interact with the toto399 platform — which sections are visited, how long sessions last, and which features are used most. This data helps toto399 identify and fix usability issues and prioritise platform improvements.
• Security Cookies: Used to detect and prevent fraudulent sessions, credential stuffing attacks, and other security threats. These cookies help toto399's fraud detection system identify anomalous login patterns.

toto399 does not use third-party advertising or retargeting cookies. You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent the toto399 platform from functioning correctly.

toto399 retains personal data for as long as it is required for the purpose for which it was collected, or as long as required by applicable legal, regulatory, or compliance obligations. The following retention periods apply:

• Account and Registration Data: Retained for the duration of the active account plus a minimum of 5 years after account closure, for regulatory compliance and dispute resolution purposes.
• KYC and Identity Documents: Retained for a minimum of 5 years from the date of verification, as required by anti-money laundering regulations.
• Financial Transaction Records: PKR deposit and withdrawal records retained for a minimum of 5 years from the date of each transaction.
• Gameplay Logs: Retained for 2 years from the date of each session for dispute resolution and responsible gaming monitoring.
• Support Communications: Retained for 2 years from the date of the conversation, then deleted unless relevant to an ongoing dispute or legal matter.
• Technical and Device Data: IP address logs retained for 12 months. Anonymised analytics data retained indefinitely.

Following the expiry of the applicable retention period, personal data is permanently deleted or anonymised so that it can no longer be attributed to an individual player. Anonymised data that cannot be re-identified may be retained indefinitely for statistical analysis.

toto399 implements the following technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• 256-bit TLS encryption on all data transmissions between your browser and toto399.games servers.
• All account passwords stored exclusively as salted bcrypt cryptographic hashes — readable only by the owner, never by toto399 staff.
• Payment and KYC data stored in encrypted form on access-controlled servers with multi-factor authentication required for staff access.
• Regular security audits and penetration testing of the toto399 platform infrastructure.
• Login anomaly detection — alerts sent to registered players when account access occurs from a new device or unusual location.
• Two-Factor Authentication (2FA) available for all toto399 accounts — strongly recommended for all players.
• Strict internal access controls — toto399 staff access to player data is role-based and limited to the minimum required for their function.

Despite these measures, no internet-based platform can guarantee absolute security. In the unlikely event of a data security incident that affects your personal data, toto399 will notify affected players as required by applicable law and will take immediate steps to contain and remediate the incident.

toto399 is an 18+ platform. We do not knowingly collect personal data from any person under the age of 18. Account registration requires confirmation of age eligibility, and age verification via CNIC is performed before any withdrawal is processed.

If toto399 becomes aware that personal data has been collected from a person under 18, all data associated with that account will be permanently deleted, the account will be suspended, and any funds associated with the underage account will be handled in accordance with our Terms and Conditions.

If you are a parent or guardian and believe your child may have registered a toto399 account, please contact us immediately at [email protected] so we can take appropriate action without delay.

To exercise any of your data rights described in this policy — access, rectification, erasure, restriction, portability, or objection — please contact toto399's Data Support team at [email protected] with the subject line "Data Rights Request" and the following information:

• Your full name and registered toto399 account email address.
• The specific right you wish to exercise and a brief description of your request.
• Any additional information that helps identify the specific data concerned.

toto399 will acknowledge your request within 3 business days and will respond substantively within 30 days of receiving a verified request. In complex cases, toto399 may extend the response period by up to a further 60 days, in which case we will notify you of the extension and the reason for it.

toto399 will not charge a fee for processing data rights requests in standard circumstances. Where a request is manifestly unfounded or excessive — for example, repetitive requests for the same data — toto399 reserves the right to charge a reasonable fee or to decline the request, with written justification provided.

toto399 may need to verify your identity before processing a data rights request to ensure that data is not disclosed to an unauthorised third party. We may ask you to confirm your registered email address and to provide a brief identity verification step before proceeding.

toto399 may update this Privacy Policy from time to time to reflect changes in our data practices, platform features, or applicable legal requirements. When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this page.
• Notify registered toto399 players via email or in-platform notification where the changes significantly affect their rights or our data practices.
• Provide a reasonable notice period before new terms take effect, except where immediate changes are required for legal or security reasons.

We encourage you to review this Privacy Policy periodically to stay informed about how toto399 protects your personal data. The current version of this policy is always available at toto399.games/privacy-policy. Continued use of the toto399 platform after the effective date of any updated policy constitutes acceptance of the updated terms.

If you have any questions about this Privacy Policy, about how toto399 handles your personal data, or if you wish to exercise any of your data rights, please contact us through the following channels:

• Email (Privacy Inquiries): [email protected] — use the subject line "Privacy Inquiry" for the fastest routing to our data support team. Responses are provided in English within 3 business days.
• Live Chat: Available 24/7 inside your logged-in toto399 account. Live Chat agents can assist with general privacy questions and will escalate data rights requests to the data support team.

This Privacy Policy is written in English and English is the governing language of this document. In the event of any inconsistency between this Privacy Policy and any translation or summary, the English version shall prevail.

This Privacy Policy should be read together with toto399's Terms & Conditions and Responsible Gaming policy, both of which contain provisions relevant to how we use your personal data in the context of platform operation and player protection.