Privacy Policy – toto21

1. Introduction and Scope

This Privacy Policy applies to all personal data collected by toto21 through the toto21 platform available at toto21.lat (the "Platform"), including during account registration, use of betting and casino services, payment transactions, customer support interactions, and any other engagement with toto21 services.

By registering for or using the toto21 Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with this policy, you should not register for or use the toto21 Platform.

This policy is directed at users located in Pakistan. toto21 is an English-language platform and all privacy communications are conducted in English.

2. Data Controller

For the purposes of this Privacy Policy, toto21 acts as the data controller in respect of personal data collected from users of the Platform. References to "toto21", "we", "us" and "our" throughout this policy refer to the toto21 operating entity responsible for the Platform.

Questions regarding this Privacy Policy or your personal data should be directed to toto21 support. Contact details are provided in Section 15 of this policy.

3. Information We Collect

3.1 Registration Information

When you create a toto21 account, we collect the personal information you provide during registration, which typically includes:

• Full name;
• Date of birth (used to verify you are 18 years of age or older);
• Email address;
• Username and password (passwords are stored in hashed form and are not accessible to toto21 staff in plain text);
• City or region of residence within Pakistan (e.g. Karachi, Lahore, Islamabad, Rawalpindi, Faisalabad).

3.2 Payment Information

When you make a deposit or withdrawal via JazzCash, Easypaisa, or bank transfer (HBL, UBL, Meezan Bank, Bank Alfalah), toto21 collects transaction reference data necessary to credit your PKR account balance and process withdrawals. toto21 does not store full bank account numbers or JazzCash/Easypaisa wallet credentials — payment authorisation is handled through the respective payment provider.

3.3 Identity Verification (KYC) Documents

For account verification and withdrawal processing, toto21 may request a copy of your Computerised National Identity Card (CNIC) or equivalent identity document. This information is held securely and used solely for the purpose of verifying your identity and age. See Section 7 for full details of KYC data handling.

3.4 Activity and Transaction Data

toto21 automatically records data about your activity on the Platform, including login times, games played, bets placed, game outcomes, deposit and withdrawal history, and session durations. This data is used to operate your account, resolve disputes, and improve Platform services.

3.5 Device and Technical Data

toto21 collects standard technical data from your device when you access the Platform, including IP address, browser type and version, operating system, device type, and referring URL. This data assists with security monitoring, fraud prevention, and Platform optimisation for Pakistani mobile and broadband network conditions.

3.6 Customer Support Communications

If you contact toto21 support, we retain records of those communications — including the nature of your query, any attachments provided, and the resolution — for quality assurance purposes and to assist in handling related future enquiries.

4. How We Use Your Information

toto21 uses the personal data it collects for the following purposes:

• To create and administer your toto21 account;
• To verify your identity and confirm you meet the 18+ age requirement;
• To process PKR deposits and withdrawals via JazzCash, Easypaisa, and local bank transfers;
• To provide and operate betting, casino, and gaming services on the Platform;
• To detect and prevent fraud, money laundering, and other prohibited activity;
• To respond to customer support queries and resolve disputes;
• To comply with applicable legal and regulatory obligations;
• To send account-related communications, including transaction confirmations, security alerts, and policy updates;
• To analyse Platform usage patterns for service improvement — this analysis is conducted on aggregated or anonymised data where practicable;
• To enforce toto21's Terms and Conditions and other applicable policies.

toto21 does not use personal data for unsolicited marketing communications without your prior consent. If you have opted in to receive promotional communications, you may opt out at any time by contacting support or using the unsubscribe mechanism in any such communication.

5. Legal Basis for Processing

toto21 processes personal data on the following legal bases:

• Contractual necessity: Processing required to perform our contract with you — account operation, game provision, payment processing;
• Legal obligation: Processing required to comply with applicable laws, including anti-money laundering requirements and age verification obligations;
• Legitimate interests: Processing for fraud detection, security monitoring, and service improvement where these interests are not overridden by your privacy rights;
• Consent: Where you have provided explicit consent for specific processing activities, such as receiving promotional communications.

6. Payment Data and Financial Information

All PKR transactions on toto21 — whether via JazzCash, Easypaisa, or local bank transfer — are processed through the respective payment provider's secure systems. toto21 receives transaction confirmation and reference data from these providers but does not store complete payment credentials on its own servers.

Transaction history is retained in your toto21 account records for the duration of your account and for a minimum period thereafter as required for financial record-keeping and dispute resolution purposes. This retention is necessary for legal compliance and to protect your interests in the event of a payment dispute.

7. KYC and Identity Verification

toto21 may request Know Your Customer (KYC) documentation — typically a copy of your CNIC — in the following circumstances:

• When you request a withdrawal above defined thresholds;
• Where toto21 has a reasonable need to verify your identity or age;
• Where required by applicable anti-money laundering or counter-terrorism financing obligations.

KYC documents are stored securely with access restricted to authorised toto21 personnel responsible for verification. Documents are not shared with third parties except where required by law or regulatory authority. toto21 will notify you via your registered email when KYC verification is required and will provide clear instructions on how to submit documents securely.

8. Cookies and Tracking Technologies

toto21 uses cookies and similar technologies on the Platform for the following purposes:

• Essential cookies: Required for Platform functionality, including maintaining your logged-in session and remembering your language and currency preferences;
• Analytics cookies: Used to understand how users interact with the Platform — pages visited, session durations, device types — to improve the user experience for Pakistani players;
• Security cookies: Used to detect and prevent fraudulent activity and unauthorised access to accounts.

You may configure your browser to block or delete cookies. Note that disabling essential cookies may impair Platform functionality, including the ability to maintain a login session. Analytics cookies can be disabled without affecting core Platform operation.

9. Sharing of Personal Data

toto21 does not sell, rent, or trade personal data. We may share your personal data with third parties only in the following limited circumstances:

• Payment processors: JazzCash, Easypaisa, and local bank transfer providers receive the data necessary to process your PKR deposits and withdrawals;
• Game software providers: Where a game is provided by a third-party studio, that studio may receive session data necessary to operate the game. No personally identifiable information beyond a session token is passed to game providers;
• Legal and regulatory authorities: Where required by applicable law, court order, or instruction from a regulatory or law enforcement authority in Pakistan or any relevant jurisdiction;
• Service providers: Third-party vendors engaged to assist in Platform operations — such as KYC verification services, fraud detection tools, or customer support infrastructure — are bound by data processing agreements that restrict their use of personal data to the specific service provided.

All third parties with whom toto21 shares personal data are required to handle such data in accordance with applicable privacy standards and are prohibited from using it for any purpose beyond the specific service they provide to toto21.

10. Data Retention

toto21 retains personal data for as long as your account is active and for a reasonable period thereafter to fulfil legal, regulatory, dispute resolution, and financial record-keeping obligations. Typical retention periods are as follows:

• Account and registration data: retained for the duration of the account and a minimum of five years following account closure;
• Transaction records: retained for a minimum of five years following the transaction date;
• KYC documents: retained for a minimum of five years following account closure or last KYC verification, whichever is later;
• Customer support communications: retained for a minimum of two years from the date of the communication.

Where data is no longer required for any purpose for which it was collected, toto21 will securely delete or anonymise it.

11. Data Security

toto21 implements technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include SSL/TLS encryption for all data transmitted between your device and the Platform, access controls restricting internal data access to authorised personnel on a need-to-know basis, regular security reviews of Platform infrastructure, and secure storage of KYC documents with audit logging.

Despite these measures, no internet transmission or electronic storage system is entirely secure. toto21 cannot guarantee the absolute security of personal data transmitted to the Platform over the internet. You transmit data at your own risk and should ensure your own device security — including using strong passwords and secure network connections — when accessing toto21.

In the event of a data security incident that is likely to result in a risk to your rights or interests, toto21 will notify affected users via their registered email address as promptly as practicable.

12. Your Rights

Subject to applicable law and verification of your identity, you have the following rights in respect of personal data held by toto21:

• Right of access: Request a copy of the personal data toto21 holds about you;
• Right to rectification: Request correction of inaccurate or incomplete personal data;
• Right to erasure: Request deletion of personal data where it is no longer necessary for the purposes for which it was collected, subject to toto21's legal retention obligations;
• Right to restriction: Request that toto21 restrict processing of your personal data in certain circumstances;
• Right to object: Object to processing of your personal data where toto21 relies on legitimate interests as the legal basis, unless toto21 can demonstrate compelling legitimate grounds that override your interests;
• Right to withdraw consent: Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact toto21 support with your request. toto21 will respond within a reasonable timeframe following identity verification. Some requests may be limited by toto21's legal obligations or by the need to retain data for dispute resolution or fraud prevention purposes.

13. Children and Minors

The toto21 Platform is strictly for adults aged 18 and above. toto21 does not knowingly collect personal data from individuals under the age of 18. If toto21 becomes aware that personal data has been collected from an individual under 18 — whether through a false age declaration at registration or otherwise — that account will be immediately closed, associated data will be handled in accordance with legal obligations, and any funds held in the account will be dealt with in accordance with the toto21 Terms and Conditions.

If you are a parent or guardian and believe your child has created a toto21 account, please contact toto21 support immediately. We will investigate and take appropriate action promptly.

14. Changes to This Policy

toto21 reserves the right to update or amend this Privacy Policy at any time. Where changes are material, toto21 will notify registered users via their registered email address or through a notice displayed on the Platform. The "Last updated" date at the top of this policy reflects the most recent revision. Continued use of the Platform following notification of changes constitutes acceptance of the revised Privacy Policy.

15. Contact and Data Requests

For any questions regarding this Privacy Policy, to exercise your data rights, or to report a privacy concern, please contact toto21 support:

Email: [email protected]

Please include "Privacy Request" in the subject line of your email. Do not send full CNIC numbers or payment credentials unless specifically requested by our verified support team as part of an identity verification process.

toto21 aims to respond to all data-related enquiries within a reasonable timeframe. Complex requests — such as full data subject access requests — may take longer to fulfil given the need to compile and verify data across multiple systems.