Privacy Policy

1 Introduction

AlexisToto ("we", "us", "our", "the Company") operates the online gaming platform accessible at https://alexistoto.lat. We take the privacy of our players seriously and are committed to handling personal data with transparency, security, and respect.

This Privacy Policy ("Policy") describes how AlexisToto collects, uses, stores, shares, and protects the personal data of individuals ("you", "Player", "User") who access or use the AlexisToto platform, including its casino games, sportsbook, live dealer tables, and associated support services.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy. In the event of any conflict, the Terms & Conditions shall prevail.

2 Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

3 Personal Data We Collect

3.1 Account Registration Data

When you register an Account with AlexisToto, we collect:

• Full legal name
• Date of birth (to verify the 21+ age requirement)
• Email address
• Mobile phone number
• Residential address (including city, postcode, and country)
• Username and encrypted password
• Preferred currency (MYR)

3.2 Identity Verification (KYC) Data

To process withdrawals and comply with our regulatory obligations, we may collect:

• Government-issued photo identification (Malaysian MyKad, passport, or equivalent)
• Proof of residential address (utility bill or bank statement dated within three months)
• Selfie or video verification for liveness checks
• Payment method ownership documentation

3.3 Financial Transaction Data

When you make deposits or withdrawals via Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, Public Bank, GrabPay, Boost, Hong Leong Bank, or cryptocurrency channels, we collect:

• Transaction amounts and timestamps
• Payment method type and masked account identifiers
• Transaction reference numbers and processing status

AlexisToto does not store full payment card numbers or full bank account numbers. Such sensitive financial data is handled exclusively by our certified payment processors.

3.4 Gaming Activity Data

• Game sessions, bet history, win/loss records, and bonus usage
• Sports betting selections, including Liga Super Malaysia, EPL, and UFC markets
• Platform feature usage patterns
• Responsible gambling tool settings and self-exclusion requests

3.5 Technical & Device Data

• IP address and approximate geolocation (city-level)
• Device type, operating system, and browser version
• Session duration and login timestamps
• Cookie identifiers and session tokens

3.6 Communications Data

• Support chat transcripts and email correspondence
• Complaint and dispute records
• Marketing preferences and communication opt-in/opt-out status

4 How We Collect Personal Data

AlexisToto collects Personal Data through the following methods:

• Directly from you: when you register, complete KYC, make deposits or withdrawals, contact support, or respond to surveys and promotions.
• Automatically: through cookies, web server logs, and analytics tools when you access and interact with the Platform.
• From third-party service providers: identity verification agencies, payment processors, fraud prevention services, and licensed game providers where necessary.
• From public sources: where legally permitted, including sanctions databases and publicly available records, for compliance and fraud prevention purposes.

5 Data Processing & Use

AlexisToto processes your Personal Data for the following purposes:

6 Legal Basis for Processing

AlexisToto processes Personal Data on the following legal grounds:

• Contractual necessity: Processing required to perform the contract between AlexisToto and the Player, including account creation, transaction processing, and service delivery.
• Legal obligation: Processing required to comply with applicable legal requirements, including KYC, anti-money laundering obligations, and regulatory directives.
• Legitimate interests: Processing necessary for fraud prevention, platform security, and responsible gambling monitoring, where such interests are not overridden by the Player's fundamental rights.
• Consent: Processing for marketing communications, where the Player has provided explicit opt-in consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

7 Data Sharing & Disclosure

7.1 Service Providers

AlexisToto shares Personal Data with carefully selected third-party service providers who process data on our behalf under binding data processing agreements. These include:

• Payment processors handling MYR transactions (Touch 'n Go eWallet, DuitNow, FPX, Maybank, CIMB, and others)
• Identity verification and KYC providers
• Fraud detection and cyber-security services
• Cloud hosting and infrastructure providers
• Licensed game content providers
• Customer support software platforms

All service providers are contractually bound to process your data solely for the purposes specified by AlexisToto and to maintain appropriate security standards.

7.2 Legal & Regulatory Disclosure

AlexisToto may disclose Personal Data to government authorities, regulatory bodies, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory directive. In such cases, we will provide only the minimum data required and will notify the affected Player where legally permissible.

7.3 No Sale of Personal Data

7.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of AlexisToto's business assets, Player data may be transferred as part of that transaction. Affected Players will be notified in advance, and the acquiring entity will be required to honour the terms of this Privacy Policy.

8 International Data Transfers

AlexisToto operates internationally and may process or store Personal Data on servers located outside of Malaysia. Where data is transferred to jurisdictions that may not offer the same level of data protection as Malaysia's Personal Data Protection Act 2010 (PDPA), AlexisToto implements appropriate safeguards including:

• Standard contractual clauses with data recipients
• Binding corporate rules for intra-group transfers where applicable
• Verification that recipient jurisdictions provide adequate protections

By using the AlexisToto Platform, Malaysian players acknowledge that their Personal Data may be transferred to and processed in other countries as part of the delivery of the Platform's services.

9 Cookies & Tracking Technologies

9.1 Types of Cookies Used

9.2 Managing Cookies

You may control cookie settings through your browser settings. Disabling essential cookies will prevent you from logging in or using core Platform features. Analytics and functional cookies may be disabled without affecting core functionality, though some personalisation features may not work as expected.

AlexisToto does not deploy third-party advertising or retargeting cookies. No data collected via cookies on the AlexisToto Platform is shared with external advertising networks.

10 Data Retention

AlexisToto retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply as a general guide:

• Account and KYC data: Retained for a minimum of five (5) years after account closure, in accordance with anti-money laundering record-keeping requirements.
• Transaction records: Retained for seven (7) years to comply with financial reporting obligations.
• Support communications: Retained for three (3) years after resolution.
• Marketing data: Retained until consent is withdrawn, plus a 12-month audit trail period.
• Technical logs and analytics: Retained for up to 24 months in anonymised or aggregated form.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where legal proceedings or regulatory investigations are ongoing, retention may be extended until those matters are fully resolved.

11 Security Measures

AlexisToto implements a comprehensive set of technical and organisational security measures to protect Personal Data against unauthorised access, disclosure, alteration, or destruction:

• Encryption: AES-256 encryption for data at rest; TLS 1.3 for all data in transit.
• Access controls: Role-based access controls ensuring staff can access only the data necessary for their function.
• Two-factor authentication: Available to all Players and enforced for all administrative staff.
• Regular security audits: Periodic penetration testing and vulnerability assessments conducted by independent security professionals.
• Incident response: A documented data breach response procedure with defined notification timelines.

12 User Rights

AlexisToto respects and upholds the data rights of all Players. You may exercise the following rights at any time by contacting our support team:

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Rights Request". AlexisToto will acknowledge your request within 48 hours and respond substantively within 30 calendar days. Complex requests may require up to 60 days; you will be notified if an extension is necessary.

13 Minors & Age Policy

AlexisToto strictly prohibits the use of its Platform by individuals under the age of 21 years. We do not knowingly collect Personal Data from persons under 21. Age verification is a mandatory step in the registration and KYC process.

If AlexisToto discovers or has reason to believe that Personal Data has been collected from a person under 21, the relevant Account will be immediately suspended, all data will be reviewed, and the account will be permanently closed. Any funds in the Account may be subject to forfeiture.

14 Policy Amendments

AlexisToto reserves the right to amend this Privacy Policy at any time. Where changes are material — such as introducing a new category of data collection or a new data sharing arrangement — we will notify registered Players by email and/or via a prominent notice on the Platform at least seven (7) days before the change takes effect.

Non-material changes (such as clarifications or formatting updates) may be published without prior notice. The date of the most recent revision is displayed at the top of this page. Your continued use of the Platform following any revision constitutes acceptance of the updated Policy.

15 Contact Us

For all privacy-related queries, data rights requests, or concerns about how AlexisToto handles your Personal Data, please contact our Data Protection team:

AlexisToto is committed to resolving all privacy concerns promptly and transparently. If you are not satisfied with our response, you may escalate the matter to the applicable data protection authority in your jurisdiction.