Introduction

MiniToto ("we", "us", "our", "the Company") operates the online betting and casino platform accessible at https://minitoto.click (the "Platform"). We act as the data controller in respect of personal data collected from users ("you", "User") who register for and use the Platform.

This Privacy Policy ("Policy") describes our practices regarding the collection, storage, use, disclosure, and protection of your personal information. It applies to all users of MiniToto's services, including players registering from Malaysia, Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations.

This Policy should be read alongside MiniToto's Terms & Conditions, which govern the overall relationship between you and the Company. By registering an Account or using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

Malaysian Users: While MiniToto is an internationally licensed platform, we recognise that Malaysian users are subject to the Personal Data Protection Act 2010 (PDPA) in respect of personal data processed within Malaysia's jurisdiction. We align our data practices with internationally recognised data protection standards consistent with responsible platform operation.

Definitions

For the purposes of this Privacy Policy, the following terms apply:

  • Personal Data: Any information relating to an identified or identifiable natural person, including but not limited to name, identification number, email address, phone number, IP address, payment details, and account activity records.
  • Processing: Any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.
  • Data Controller: MiniToto, which determines the purposes and means of processing your Personal Data.
  • Data Processor: A third party that processes Personal Data on behalf of MiniToto under contractual obligation and our instructions.
  • KYC Data: Identity and document verification data collected as part of the Know Your Customer process, including government-issued identification, proof of address, and payment method verification.
  • Consent: A freely given, specific, informed, and unambiguous indication of a User's agreement to the processing of their Personal Data for a stated purpose.
  • Account: A registered user profile on the MiniToto Platform.

Data We Collect

MiniToto collects the following categories of personal data, limited to what is necessary for the purposes described in Section 5 of this Policy:

Identity Data Full name, date of birth, nationality, MyKad or passport number (for KYC verification).
Contact Data Email address, phone number, registered city of residence (e.g. Kuala Lumpur, Penang, Johor Bahru).
Financial Data MYR deposit and withdrawal records, payment method identifiers (e.g. masked e-wallet ID, bank account number for DuitNow / FPX), cryptocurrency wallet addresses.
Transaction & Betting Data Wager history, game play logs, win/loss records, bonus redemption history, session timestamps.
Technical Data IP address, device type, browser type and version, operating system, screen resolution, referring URL, session duration.
KYC Documentation Copies of government-issued photo identification, proof of address documents, and payment method verification records submitted during verification.
Communications Data Records of your correspondence with MiniToto support via live chat, email, or ticketing systems, including timestamps and content.
Responsible Gambling Data Self-exclusion elections, deposit limit settings, session time preferences, and any disclosures made in the context of responsible gambling support.

How We Collect Data

4.1 Directly from You

The majority of personal data we hold is provided directly by you during the Account registration process, when completing KYC verification, when making deposits or withdrawal requests (including payments via Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, FPX, or cryptocurrency), when contacting our support team, and when updating your Account preferences.

4.2 Automatically During Platform Use

Technical data — including IP address, device identifiers, browser information, and session activity — is collected automatically when you access the Platform. This data is used for security monitoring, fraud prevention, platform optimisation, and ensuring service integrity.

4.3 From Third Parties

We may receive data about you from third-party service providers, including: payment processors and e-wallet providers (to verify transaction completion); KYC and identity verification partners; anti-fraud screening services; and analytics providers who assist with Platform performance monitoring. All third-party data processors are bound by contractual data protection obligations.

Purposes of Data Processing

MiniToto processes your personal data exclusively for the following purposes:

  • Account Management: Creating, maintaining, and administering your registered Account, including authentication and security.
  • Service Delivery: Processing deposits and withdrawals, settling bets and game outcomes, crediting bonuses and loyalty points, and providing access to all Platform features.
  • Identity Verification (KYC): Verifying your identity and age (21+ requirement) as required under our responsible gambling obligations and international licensing conditions.
  • Fraud Prevention & Security: Detecting and preventing fraudulent activity, money laundering, account takeover, and other prohibited conduct as defined in our Terms & Conditions.
  • Legal & Regulatory Compliance: Meeting obligations under our international operating licence, anti-money-laundering (AML) requirements, and applicable law.
  • Responsible Gambling: Monitoring account activity for indicators of problem gambling behaviour; administering self-exclusion, deposit limits, and other responsible gambling tools.
  • Customer Support: Responding to your enquiries, resolving disputes, and managing feedback submitted through support channels.
  • Platform Improvement: Analysing aggregated usage data to improve Platform performance, user experience, and feature development.
  • Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to Users who have not opted out of marketing communications. You may opt out at any time by contacting support.
No Data Selling: MiniToto does not sell, rent, or trade your personal data to third-party marketers or advertising networks. Data shared with service providers is strictly limited to what is necessary for each provider's contracted function.

Data Sharing & Disclosure

7.1 Service Providers

MiniToto shares personal data with carefully selected third-party service providers who assist in delivering the Platform's services. These include payment processing partners (including providers that facilitate Touch 'n Go eWallet, Boost, Maybank, CIMB, DuitNow, FPX, and cryptocurrency transactions), KYC and identity verification platforms, anti-fraud technology providers, cloud hosting and infrastructure providers, and customer support software vendors. All such providers are bound by contractual data processing agreements and are prohibited from using your data for any purpose other than the specific service they provide.

7.2 Legal Disclosure

We may disclose personal data to law enforcement agencies, regulatory bodies, courts, or other governmental authorities where required to do so by applicable law, valid legal process, or in connection with the investigation or prosecution of illegal activity, fraud, or a breach of our Terms & Conditions.

7.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of MiniToto's business assets, personal data may be transferred to the acquiring entity as part of that transaction, subject to appropriate confidentiality protections and the continuity of data rights for Users.

7.4 No Third-Party Marketing

MiniToto does not share, sell, or disclose your personal data to third-party advertising networks or data brokers for marketing purposes. We may use aggregated, anonymised data (which cannot identify you individually) for market analysis, but this is not considered personal data processing.

Data Retention

MiniToto retains personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following retention principles:

  • Active Account Data: Retained for the duration of the Account relationship and for a period of five (5) years following Account closure, to satisfy AML record-keeping obligations and to resolve any disputes that may arise.
  • KYC Documents: Retained for a minimum of five (5) years from the date of the last transaction or Account closure, in accordance with international AML and Know Your Customer standards.
  • Transaction Records: Deposit, withdrawal, and betting history records are retained for a minimum of five (5) years following the relevant transaction, as required under financial record-keeping obligations.
  • Support Communications: Retained for three (3) years from the date of last interaction, unless a longer retention period is required in connection with a specific dispute or investigation.
  • Marketing Consent Records: Retained until you withdraw consent and for a reasonable period thereafter to demonstrate compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

Data Security

MiniToto implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security practices include, but are not limited to:

  • 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
  • Encryption of sensitive data at rest within our database infrastructure.
  • Role-based access controls limiting internal staff access to personal data strictly to those with a legitimate operational need.
  • Regular security assessments, penetration testing, and vulnerability scanning of Platform systems.
  • Multi-factor authentication requirements for administrative access to internal systems.
  • Secure, redundant data centre infrastructure with physical access controls.
Data Breach Notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, MiniToto will notify affected Users within a reasonable timeframe and take immediate remediation steps. You are encouraged to maintain a strong, unique password for your Account and to enable any available two-factor authentication.

Cookies & Tracking Technologies

10.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. MiniToto uses cookies and similar technologies (including local storage and session tracking) to operate the Platform effectively, improve user experience, and maintain security.

10.2 Types of Cookies We Use

  • Strictly Necessary Cookies: Required for the Platform to function, including session management, authentication tokens, and security cookies. These cannot be disabled.
  • Functional Cookies: Remember your preferences such as language settings, saved Account details (excluding passwords), and UI configuration choices.
  • Analytics Cookies: Help us understand how users interact with the Platform, including pages visited, session duration, and feature usage. Data is aggregated and anonymised.
  • Security Cookies: Used to detect and prevent fraudulent account activity, including session hijacking attempts.

10.3 Managing Cookies

You may manage non-essential cookie preferences through your browser settings. Note that disabling certain cookies may impair Platform functionality. Strictly necessary cookies cannot be disabled as they are required for secure access to your Account.

Your Data Rights

Subject to applicable law and certain exemptions (such as AML record-keeping obligations), you have the following rights in respect of your personal data held by MiniToto:

Right Description
Right of Access You may request a copy of the personal data MiniToto holds about you. We will respond within a reasonable timeframe, typically within 30 days.
Right to Rectification If the personal data we hold is inaccurate or incomplete, you may request correction or completion. Account profile details can be updated directly via your Account settings or by contacting support.
Right to Erasure You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our retention obligations under AML and licensing requirements.
Right to Restriction You may request that we restrict the processing of your data in certain circumstances, for example while we investigate a rectification request or a dispute.
Right to Data Portability Where technically feasible, you may request your personal data in a structured, commonly used, and machine-readable format, applicable to data provided directly by you.
Right to Object You may object to processing based on legitimate interests at any time. You may also opt out of direct marketing communications at any time by contacting support.
Withdraw Consent Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of the above rights, please contact our support team at the details provided in Section 15. We may require identity verification before processing certain requests to prevent unauthorised access to your data.

Minors & Age Policy

MiniToto's services are strictly for individuals aged 21 years or older. We do not knowingly collect personal data from persons under the age of 21. Age verification is conducted as part of the KYC process, and accounts where age cannot be verified are suspended pending resolution.

If MiniToto becomes aware that personal data has been collected from a user who is under 21, such data will be deleted promptly and the associated Account will be permanently closed. Any funds associated with an underage account may be returned to the original payment source after deducting any bonuses or promotions that were utilised.

If you believe a minor has created a MiniToto Account: Please contact our support team immediately. We take underage gambling with the utmost seriousness and will investigate and act on any such report without delay.

International Data Transfers

As an internationally licensed platform, MiniToto may transfer your personal data to, and process it in, countries outside of Malaysia. This includes transfers to our data centre infrastructure, third-party service provider systems, and KYC verification platforms which may be hosted in jurisdictions with different data protection frameworks.

Where personal data is transferred internationally, MiniToto ensures that appropriate safeguards are in place to protect your data, including contractual data transfer agreements with service providers based on recognised international standard contractual clauses or equivalent mechanisms. We do not transfer data to jurisdictions that do not provide an adequate level of data protection without appropriate additional safeguards.

Policy Amendments

MiniToto reserves the right to update or amend this Privacy Policy at any time. Material changes to how we collect or use your personal data will be communicated to registered Users via the email address on file or through a prominent notice on the Platform prior to the change taking effect.

The "Last Updated" date at the top of this document indicates when the Policy was most recently revised. Your continued use of the Platform after the effective date of an updated Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you may request Account closure in accordance with the Terms & Conditions.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, you may contact MiniToto through the following channels. Please reference "Privacy Policy Enquiry" in your subject line or opening message to help us direct your query appropriately.

Email
[email protected]

Response within 2 hours during peak hours

Live Chat
Available 24/7, 365 days a year

Average response under 2 minutes

When submitting a data rights request (Section 11), please include your registered Account username (not your password) and a clear description of your request. Identity verification may be required before we process certain types of data requests to protect against unauthorised access.