toto21 Privacy Policy

1. Introduction

toto21 ("toto21," "we," "us," or "our") operates the online gaming platform accessible at toto21.club (the "Platform"). We are committed to protecting the privacy and personal data of every player who registers and uses our services.

This Privacy Policy describes how toto21 collects, uses, stores, shares, and protects personal information in connection with your use of the Platform. It applies to all players, visitors, and individuals who interact with toto21 through our website, customer support channels, or any other means.

toto21 processes personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the guidelines issued by the National Privacy Commission (NPC) of the Philippines. Where applicable, toto21 also observes the data protection requirements of PAGCOR, the Philippine Amusement and Gaming Corporation.

This Privacy Policy should be read together with toto21's Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference.

2. Personal Data We Collect

toto21 collects personal data that is necessary to provide our services, verify your identity, process transactions, and comply with our legal and regulatory obligations. The categories of personal data we collect include:

2.1 Identity and Contact Information

• Full legal name as it appears on your government-issued identification
• Date of birth (to verify that you are at least 21 years of age)
• Residential address, including barangay, city or municipality, province, and postal code
• Email address
• Mobile number (Philippine mobile number preferred)
• Nationality and country of residence

2.2 Identity Verification Documents

• Copies of government-issued photo identification (e.g., Philippine passport, driver's license, SSS ID, UMID, PhilSys National ID, PRC ID, Voter's ID)
• Proof of address documents (e.g., utility bills, bank statements, barangay certificates)
• Selfie or liveness verification images where required for KYC purposes

2.3 Financial Information

• Payment method details (e.g., GCash-registered mobile number, PayMaya account reference, BPI, BDO, or Metrobank account name)
• Transaction history, including deposits, withdrawals, and bonus credits
• Source of funds information where required by AML regulations

2.4 Gaming Activity Data

• Game history, bet amounts, win/loss records, and session durations
• Responsible gaming settings, including deposit limits and self-exclusion status
• Bonus and promotion usage history

2.5 Technical and Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Cookie identifiers and session tokens
• Platform usage logs, including login timestamps and navigation patterns

2.6 Communications Data

• Records of communications with toto21 customer support, including live chat transcripts and email correspondence
• Feedback, survey responses, and complaint records

3. How We Collect Your Data

toto21 collects personal data through the following means:

• Account Registration: When you create a toto21 account, you provide identity and contact information directly through the registration form.
• KYC Verification: When you submit identity documents to complete Know Your Customer verification, we collect and process the information contained in those documents.
• Deposits and Withdrawals: Financial data is collected when you initiate deposit or withdrawal transactions through supported payment methods such as GCash, PayMaya, BPI, BDO, and Metrobank.
• Platform Usage: Technical and gaming activity data is collected automatically as you use the Platform, through server logs, cookies, and similar tracking technologies.
• Customer Support: When you contact toto21 support via live chat or email, we collect the information you provide in those communications.
• Third-Party Sources: In limited circumstances, toto21 may receive data from third-party identity verification providers, fraud prevention services, or payment processors to supplement the information you have provided directly.

4. How We Use Your Personal Data

toto21 uses the personal data we collect for the following purposes:

toto21 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your consent or establishing another lawful basis for processing.

5. Legal Basis for Processing

toto21 processes your personal data on one or more of the following legal bases as recognized under the Philippine Data Privacy Act of 2012:

• Contractual Necessity: Processing is necessary to perform the contract between you and toto21 — specifically, to operate your account, process transactions, and deliver gaming services.
• Legal Obligation: Processing is required to comply with applicable laws and regulations, including KYC requirements, AML obligations, and PAGCOR regulatory requirements.
• Legitimate Interests: Processing is necessary for toto21's legitimate interests, including fraud prevention, platform security, and responsible gaming monitoring, provided these interests are not overridden by your rights and freedoms.
• Consent: For certain processing activities, such as sending marketing communications or using non-essential cookies, toto21 relies on your freely given, specific, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing and Disclosure

toto21 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Privacy Policy:

6.1 Service Providers

toto21 engages trusted third-party service providers to assist in operating the Platform, including payment processors (GCash, PayMaya, BPI, BDO, Metrobank), identity verification providers, cloud hosting services, customer support platforms, and fraud detection services. These providers are contractually bound to process your data only on toto21's instructions and in accordance with applicable data protection law.

6.2 Regulatory and Law Enforcement Authorities

toto21 may disclose personal data to PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), or other competent Philippine authorities where required by law, court order, or regulatory directive. toto21 will notify you of such disclosures where legally permitted to do so.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of toto21's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy practices of the successor entity prior to the transfer taking effect.

7. Cookies and Tracking Technologies

toto21 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, analyze usage patterns, and support security functions. The types of cookies we use include:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that keep you logged in and security tokens that protect against cross-site request forgery. These cannot be disabled.
• Functional Cookies: Remember your preferences, such as language settings and responsible gaming configurations, to provide a more personalized experience.
• Analytics Cookies: Collect aggregated, anonymized data about how players use the Platform to help toto21 improve performance and user experience. toto21 uses privacy-respecting analytics tools that do not share data with advertising networks.
• Security Cookies: Used to detect and prevent fraudulent activity, including bot detection and device fingerprinting for account security purposes.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies may affect the functionality of the Platform. toto21 does not use third-party advertising cookies or behavioral tracking cookies for ad targeting purposes.

8. Data Retention

toto21 retains personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements. The following general retention periods apply:

Upon expiry of the applicable retention period, toto21 will securely delete or anonymize your personal data in accordance with our data disposal procedures. Where data is anonymized, it may be retained indefinitely for statistical and analytical purposes.

9. Data Security

toto21 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the toto21 Platform
• Encryption at rest for sensitive personal data stored in toto21's databases
• Access controls limiting access to personal data to authorized toto21 personnel on a strict need-to-know basis
• Multi-factor authentication for internal systems that process personal data
• Regular security audits and penetration testing of the Platform infrastructure
• Incident response procedures to detect, contain, and report data breaches in accordance with NPC notification requirements
• Staff training on data protection obligations and secure data handling practices

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, toto21 will notify the National Privacy Commission within 72 hours of becoming aware of the breach and will inform affected players without undue delay.

10. Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by toto21:

• Right to be Informed: You have the right to be informed about how toto21 collects and processes your personal data, as set out in this Privacy Policy.
• Right of Access: You may request a copy of the personal data toto21 holds about you, along with information about how it is being processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data. You can update basic account information directly through your toto21 account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to toto21's legal and regulatory retention obligations.
• Right to Object: You may object to the processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, though toto21 may be entitled to continue processing where there are compelling legitimate grounds.
• Right to Data Portability: You may request a copy of your personal data in a structured, commonly used, and machine-readable format where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission of the Philippines if you believe toto21 has processed your personal data in violation of applicable law.

To exercise any of the above rights, please contact toto21's Data Protection Officer using the contact details provided in Section 13 of this Privacy Policy. toto21 will respond to all verified data subject requests within thirty (30) days of receipt, or within such extended period as permitted by applicable law.

11. Children's Privacy and Age Restriction

The toto21 Platform is strictly intended for individuals who are at least 21 years of age. toto21 does not knowingly collect personal data from persons under 21 years of age. The minimum age requirement is enforced through our KYC verification process, which requires all players to submit valid government-issued identification confirming their date of birth.

If toto21 becomes aware that personal data has been collected from a person under 21 years of age, we will immediately suspend the associated account, delete the personal data in question, and take appropriate action in accordance with our Terms & Conditions and applicable law.

12. Updates to This Privacy Policy

toto21 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The date of the most recent revision is displayed at the top of this page.

Where changes are material — meaning they significantly affect your rights or how toto21 processes your personal data — toto21 will provide advance notice via email to your registered address or through a prominent notice on the Platform. Non-material changes, such as typographical corrections or clarifications, may take effect immediately upon publication.

Your continued use of the toto21 Platform following the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with the updated Privacy Policy, you should cease using the Platform and may request account closure by contacting our support team.

13. Contact Us and Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or toto21's data processing practices, please contact us through the following channels:

• Data Protection Officer (DPO):
  toto21 has designated a Data Protection Officer responsible for overseeing compliance with the Philippine Data Privacy Act. DPO inquiries may be directed to:
  support@toto21.club
• General Support:
  For general privacy inquiries or to exercise your data subject rights, you may also reach our support team via live chat, available 24/7 directly on the toto21 Platform.
• National Privacy Commission (NPC):
  If you are not satisfied with toto21's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines, the supervisory authority responsible for enforcing the Data Privacy Act of 2012.