domtoto Privacy Policy

This Privacy Policy applies to personal data processed through the domtoto website and related account functions. It covers information supplied directly by users, technical information generated during a visit and records produced when an eligible user interacts with casino, sports, payment or support features.

For this policy, personal data means information that identifies a person or can reasonably be linked with an identifiable person. Processing includes collecting, recording, organising, using, storing, reviewing, disclosing or deleting information. A user means any individual who accesses domtoto, whether or not that person maintains an account.

domtoto is intended for adults aged 21 and above. The website is not directed at children or underage users. A person below the required age must not submit personal data, create an account, make a deposit or use gambling-related features.

Identity and account information

domtoto may collect a name, date of birth, username, residential information, preferred language and other details supplied during registration or verification. Where necessary, identity documents or proof of address may be requested to verify age, account ownership or eligibility.

Contact information

Contact data may include an email address, telephone number or communication preferences. Such information may be used to deliver security notices, respond to an enquiry, confirm important account activity or provide service-related information.

Transaction and payment information

domtoto may process transaction amounts, dates, status records, masked account identifiers and the payment channel used. Malaysian options may include Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, DuitNow or FPX. Full card or banking credentials should never be sent through an ordinary message.

Gaming and responsible-play information

Records may include deposits, withdrawals, wagers, selected casino games, sports markets, bonus activity, session duration and responsible gambling limits. For example, activity involving EPL, Liga Super Malaysia or live dealer games may form part of an account history. domtoto may use those records to settle activity, investigate disputes and identify signs of harmful or irregular play.

Technical and usage data

Technical information may include an IP address, browser type, device category, operating system, approximate location, page activity, timestamps and diagnostic records. domtoto uses this information to maintain functionality, detect security threats and understand how website sections perform across mobile and desktop devices.

Information is collected directly when a user enters account details, communicates with domtoto, requests verification, sets a responsible gambling limit or initiates a payment. Users are responsible for ensuring that information supplied to domtoto is accurate, current and lawfully provided.

Other information is generated automatically during website use. Server records, security tools and cookies may record device or session information. This assists domtoto in remembering essential settings, protecting accounts and diagnosing technical faults.

Information may also be received from payment processors, identity-verification services or other service providers supporting an authorised function. domtoto expects such information to be obtained and shared through appropriate processes. Users should review any separate notice presented by their bank, card provider or eWallet service.

domtoto may process personal data where reasonably necessary to:

• create, administer, authenticate and protect a user account;
• confirm identity, age, payment ownership and account eligibility;
• record deposits, withdrawals, wagers, settlements and MYR transaction history;
• provide requested website features and respond to user enquiries;
• apply bonus terms, account restrictions and responsible gambling controls;
• detect fraud, duplicate accounts, payment misuse or unauthorised access;
• maintain website performance and investigate technical errors;
• keep records needed for disputes, security reviews or applicable obligations; and
• deliver optional communications where the user has an appropriate choice.

The applicable basis for processing depends on the purpose and circumstances. It may include performing an agreement, meeting an applicable obligation, protecting legitimate operational or security interests, or acting with the user’s consent where consent is appropriate. When domtoto relies on consent, the user may withdraw that consent for future processing, subject to activities that have another valid basis.

Payments require careful handling because transaction records may be financially sensitive. domtoto may retain the payment method type, transaction reference, amount, currency, status and time. Where MYR deposits or withdrawals are available, information may be exchanged with the selected provider to complete the transaction and confirm ownership.

Verification may involve comparing account details with identity or payment documentation. domtoto may request additional information when a transaction is unusual, when account ownership is uncertain or when a withdrawal requires review. Documents should be supplied only through the designated secure process.

domtoto does not ask a user to disclose a password, one-time banking code or full payment credential by ordinary email. Users should verify the displayed recipient, amount and payment channel before approving any transaction. Suspected payment fraud should be reported promptly to the relevant financial provider and to domtoto.

Cookies are small data files stored by a browser. domtoto may use essential cookies to support navigation, session continuity, security and user preferences. Disabling essential cookies may prevent selected website or account functions from operating correctly.

Functional or analytical technologies may help domtoto understand page performance, device compatibility and general usage patterns. Where a choice is required, users should be given an appropriate opportunity to manage non-essential technologies. Browser settings may also permit users to delete or block certain cookies.

Cookie duration varies by purpose. A session cookie generally expires when the browser closes, while a persistent cookie may remain for a defined period. domtoto does not use cookie information to guarantee gaming outcomes or determine that a user will win.

domtoto may disclose relevant information to carefully selected service providers that support hosting, cybersecurity, payments, account verification, communications, technical maintenance or professional advice. Providers should receive only information reasonably required for their authorised function and should be subject to suitable confidentiality and security duties.

Information may also be disclosed where reasonably necessary to protect users, prevent fraud, investigate unlawful activity, enforce domtoto terms or respond to a valid legal requirement. domtoto does not disclose personal information merely because another person claims to know an account holder.

A business reorganisation may require relevant data to transfer as part of the affected service, subject to appropriate safeguards. domtoto does not treat personal information as a list to be sold for unrelated third-party advertising.

domtoto applies reasonable technical and organisational measures intended to protect personal information against unauthorised access, disclosure, alteration, misuse or accidental loss. Measures may include access restrictions, monitoring, authentication, secure transmission and internal procedures appropriate to the data involved.

No internet system can be guaranteed completely secure. Users also have an important role in protecting their information. A domtoto password should be unique, difficult to guess and kept confidential. Users should sign out on shared devices and should never disclose one-time codes to another person.

If domtoto identifies a security incident affecting personal data, the incident may be investigated, contained and documented. Appropriate users or authorities may be notified when required or reasonably necessary. A user who suspects unauthorised account access should change affected credentials and report the concern promptly.

domtoto retains personal data only for as long as reasonably required for the purpose for which it was collected, subject to security, dispute, payment, responsible gambling and record-keeping needs. Different information categories may therefore have different retention periods.

Closing an account does not always result in immediate deletion of every record. domtoto may need to preserve selected identity, transaction, self-exclusion or security information to resolve an outstanding matter, prevent account misuse or satisfy an applicable retention requirement.

When information is no longer required, domtoto may delete, anonymise or securely dispose of it. Anonymised information that can no longer reasonably identify a person may be retained for statistical, security or service-improvement purposes.

International processing

Some technical or operational providers may process information in a location different from the user’s location. Where this occurs, domtoto seeks to use appropriate contractual, organisational or technical safeguards suited to the nature of the transfer. Privacy and data-protection rules may differ between jurisdictions.

Responsible gambling records

domtoto may process information about deposit limits, cooling-off periods, self-exclusion and unusual gaming patterns to support responsible gambling measures. Such records may remain necessary even after an account is closed so that a valid restriction cannot be avoided through a new registration.

Age restrictions

domtoto is for players aged 21 and above only. If information indicates that an underage person has attempted to use the website, domtoto may restrict access, request verification and remove data where retention is not otherwise required. A parent or guardian who reasonably believes that an underage person supplied information may raise the matter using the website email displayed below.

Changes to this policy

domtoto may update this Privacy Policy to reflect changes in website functions, security practices, payment arrangements or applicable requirements. The current version will be published on this page. Users should review the policy periodically, particularly before supplying new personal information.

Privacy questions and requests

Questions about this policy or requests relating to personal information may be sent to the domtoto website email shown as plain text in the footer. A request should explain the issue clearly and include only the information reasonably needed to identify the relevant account. Passwords, one-time codes and full banking credentials must never be included.

Verification and response

domtoto may ask for reasonable proof of identity before responding to an access, correction or deletion request. This protects the user from unauthorised disclosure. Complex requests may require additional time, and domtoto may decline or limit a request where a valid exception applies. Where appropriate, an explanation will be provided.