toto21 Privacy Policy

Who We Are

toto21 is an internationally licensed online casino and sports betting platform operating at toto21.bar. References to "toto21", "we", "us", or "our" throughout this Privacy Policy refer to the toto21 platform and its operating entity, which holds an international gaming licence authorising the provision of online gaming and wagering services.

toto21 is the data controller in respect of the personal information collected through the toto21 platform. This means toto21 determines the purposes for which your personal data is collected and the manner in which it is processed. Where toto21 engages third-party service providers to process data on its behalf — such as payment processors handling JazzCash and EasyPaisa transactions — those providers act as data processors under toto21's instructions.

If you have any questions about this Privacy Policy or about how toto21 handles your personal data, you can contact our support team at any time via live chat on the platform or by emailing [email protected].

Data We Collect

toto21 collects personal data in the following categories. We only collect data that is necessary, relevant, and proportionate to the purposes described in this Privacy Policy.

toto21 does not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life or sexual orientation. If you volunteer such information in correspondence with our support team, it will be used solely for the purpose of addressing your query and will not be retained beyond what is necessary for that purpose.

How We Collect Your Data

toto21 collects personal data through the following channels and mechanisms:

• Account Registration: When you create a toto21 account, you directly provide identity and contact data, including your name, date of birth, city, email address, and mobile number.
• KYC Verification: When you submit identity documents (CNIC, passport, proof of address) to complete the toto21 Know Your Customer verification process, we collect the personal data contained in those documents.
• Deposits and Withdrawals: When you make a deposit via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, SadaPay, or USDT TRC20, financial data is collected directly and/or via the relevant payment processing partner.
• Platform Activity: When you browse, play games, or place bets on toto21, technical and usage data is collected automatically through cookies, server logs, and session tracking technologies.
• Support Interactions: When you contact toto21 via live chat or email, the content and metadata of those communications are collected and stored.
• Third-Party Sources: In some circumstances, toto21 may receive identity data from third-party identity verification providers used as part of the KYC process, or fraud-prevention data from payment processors and risk-screening tools.

How We Use Your Data

toto21 uses the personal data we collect for the following purposes:

• Account Management: To create, maintain, and administer your toto21 player account, including processing logins, managing your balance, and recording your activity history.
• Payment Processing: To process deposits received via JazzCash, EasyPaisa, and Pakistani bank transfers, and to execute withdrawal requests back to your registered payment method.
• Identity Verification (KYC): To verify your identity, confirm your age (21+ requirement), and comply with anti-money laundering (AML) and know-your-customer obligations under toto21's operating licence.
• Fraud Prevention and Security: To detect and prevent fraudulent activity, unauthorised account access, bonus abuse, multi-accounting, money laundering, and other prohibited conduct as defined in the toto21 Terms and Conditions.
• Platform Improvement: To analyse usage patterns, understand how players interact with games and features, and improve the quality, performance, and usability of the toto21 platform over time.
• Customer Support: To respond to your queries, complaints, and support requests submitted via live chat or email in a timely and effective manner.
• Marketing Communications: Where you have opted in, to send you promotional offers, bonus notifications, and platform updates via email, SMS, or push notifications. You may opt out at any time.
• Responsible Gaming: To monitor gameplay patterns that may indicate problem gambling behaviour, and to facilitate self-imposed responsible gaming tools such as deposit limits, cooling-off periods, and self-exclusion requests. 21+ only.
• Legal and Regulatory Compliance: To meet obligations imposed by toto21's international gaming licence, AML regulations, and any applicable data protection requirements, including responding to lawful requests from regulatory authorities.

Legal Basis for Processing

toto21 processes your personal data on the following legal grounds, consistent with the principles of major international data protection frameworks:

• Contractual Necessity: Processing that is necessary to perform the contract between you and toto21 — including account registration, deposit and withdrawal processing, game access, and customer support.
• Legal Obligation: Processing required to comply with legal and regulatory obligations applicable to toto21's international gaming licence, including KYC identity verification, AML transaction monitoring, and record-keeping requirements.
• Legitimate Interests: Processing necessary for toto21's legitimate business interests, including fraud prevention, platform security, abuse detection, and internal analytics — provided those interests are not overridden by your fundamental privacy rights.
• Consent: Processing based on your freely given, specific, and informed consent — primarily for marketing communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Sharing Your Data

toto21 does not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. Your data may be shared with third parties only in the following limited and controlled circumstances:

• Payment Processors: Your financial data is shared with payment service providers — including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, SadaPay, and relevant USDT TRC20 blockchain infrastructure — solely to the extent necessary to process your requested transactions.
• Identity Verification Providers: toto21 may share identity documents with third-party KYC verification partners to validate your CNIC, passport, or proof of address as part of our mandatory identity verification process.
• Fraud Prevention Services: Technical and identity data may be shared with fraud screening and risk assessment providers to detect and prevent unauthorised activity on the toto21 platform.
• Game Software Providers: Where toto21 integrates third-party game engines (for live casino, slots, and other games), limited technical data (such as your anonymised session ID and stake information) may be processed by those providers' systems to deliver the game experience.
• Regulatory Authorities: toto21 will disclose personal data to its licensing authority, law enforcement agencies, or other competent regulatory bodies where required to do so by law, court order, or the terms of the operating licence.
• Professional Advisors: toto21's legal counsel, auditors, and compliance consultants may access personal data on a strictly confidential, need-to-know basis where required to provide professional services.

All third parties engaged by toto21 to process personal data are required to maintain appropriate technical and organisational security measures and are contractually prohibited from using your data for any purpose beyond the specific task for which they have been engaged.

Cookies & Tracking Technologies

toto21 uses cookies and similar tracking technologies to ensure the platform functions correctly, to remember your preferences, and to gather analytics data that helps us improve the user experience for Pakistani players. The following types of cookies are used on the toto21 platform:

• Strictly Necessary Cookies: These cookies are essential for the toto21 platform to function. They enable you to log in, navigate between pages, and maintain your session. The platform cannot function without these cookies and they cannot be disabled.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, display settings, and whether you have acknowledged any platform notices — to provide a more personalised experience.
• Analytics Cookies: toto21 uses analytics tools to understand how players use the platform — which pages are visited most frequently, where users encounter difficulties, and how navigation flows perform. This data is aggregated and anonymised wherever possible.
• Security Cookies: These cookies assist in detecting and preventing fraudulent activity, unauthorised logins, and bot traffic on the toto21 platform.

You can manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from accessing the toto21 platform entirely. Disabling functional or analytics cookies may degrade your experience on the platform but will not prevent access.

Data Retention

toto21 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law, regulatory obligations, or the conditions of the toto21 international gaming licence. The following general retention periods apply:

• Active Account Data: Retained for the duration of your account's active existence on the toto21 platform, plus a minimum of five years following account closure — in line with standard AML record-keeping requirements.
• Transaction Records: Deposit and withdrawal transaction data, including associated payment method information, is retained for a minimum of five years from the date of each transaction.
• KYC Documents: Identity verification documents (CNIC copies, passport scans, proof of address) are retained for a minimum of five years following the conclusion of the business relationship.
• Support Communications: Records of live chat and email communications are retained for three years from the date of each interaction, unless a longer period is required in connection with an unresolved dispute or regulatory inquiry.
• Marketing Data: Opt-in records and associated marketing preference data are retained for the duration of your account plus two years, or until you withdraw consent, whichever is earlier.

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any individual player.

Data Security

toto21 takes the security of your personal data seriously and has implemented a range of technical and organisational security measures designed to protect your information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption across all data transmitted between your device and the toto21 platform.
• Encrypted storage of all personally identifiable information and financial data in access-controlled server environments.
• Hashed (one-way encrypted) storage of player passwords — toto21 staff cannot view your password in plain text.
• Two-factor authentication (2FA) via SMS, available to all toto21 account holders and strongly recommended.
• Regular internal and third-party security audits and penetration testing of the toto21 platform infrastructure.
• Role-based access controls ensuring that toto21 staff can only access the player data necessary for their specific job function.
• Documented incident response procedures for detecting, managing, and reporting data security incidents where legally required.

While toto21 employs all reasonable and industry-standard security measures, no online platform can guarantee absolute security. You also have a responsibility to keep your toto21 account credentials secure — please do not share your password with anyone, and enable 2FA to protect your account.

Your Rights

As a player registered with toto21, you hold the following rights in respect of your personal data. These rights may be exercised at any time by contacting our support team via live chat or by emailing [email protected]:

toto21 will respond to all data rights requests within 30 days of receipt. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day period.

Please note that certain rights are subject to limitations where toto21 is required to retain data to fulfil legal obligations — for example, AML transaction records that must be kept for a minimum of five years cannot be erased on request during that retention period.

Children's Privacy

toto21 is strictly an adult platform. The minimum age requirement to register and use toto21 is 21 years of age. toto21 does not knowingly collect, store, or process personal data relating to individuals under the age of 21.

During the registration process, all players are required to confirm that they are aged 21 or over. toto21 enforces mandatory KYC age verification for all accounts before withdrawals are processed, and may request proof of age at any time during the customer relationship.

If toto21 becomes aware that a player account has been registered by a person under the age of 21, the account will be immediately suspended, all associated personal data will be securely deleted, and any funds in the account will be handled in accordance with the applicable regulatory requirements. Any winnings accrued by an underage player will be forfeited.

If you have reason to believe that a minor has registered on the toto21 platform, please notify us immediately at [email protected].

Third-Party Links

The toto21 platform may, from time to time, contain references to third-party services — such as payment gateway interfaces for JazzCash, EasyPaisa, or bank portals — that are accessed as part of the deposit or withdrawal process. Once you navigate away from the toto21 platform to a third-party website or service, this Privacy Policy no longer applies.

toto21 has no control over the privacy practices or content of third-party websites and accepts no responsibility for their privacy policies or the way in which they handle your personal data. We encourage you to review the privacy policy of any third-party service you access in connection with your use of toto21.

Updates to This Privacy Policy

toto21 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, regulatory requirements, or the services offered on the platform. The date of the most recent revision is displayed at the top of this page.

Where changes to this Privacy Policy are material — meaning they significantly affect your rights or the way in which toto21 uses your personal data — we will notify registered players via their registered email address and/or via a prominent notice on the toto21 platform, with reasonable advance notice before the changes take effect.

Minor or administrative amendments — such as corrections to typographical errors or clarifications that do not change the substance of our data practices — may take effect immediately upon publication. Your continued use of the toto21 platform following the publication of any revised Privacy Policy constitutes your acknowledgment of the updated terms.

We recommend reviewing this Privacy Policy periodically to stay informed about how toto21 protects your personal data.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way toto21 processes your personal data, please contact our support team through either of the following channels:

• Live Chat: Available 24/7 directly on the toto21 platform. Average first response time is 3–5 minutes.
• Email: [email protected] — for privacy-related requests, data access inquiries, consent withdrawal requests, and formal data-related complaints. We aim to respond within one business day and will provide a substantive response within 30 days.

When submitting a privacy-related request by email, please include "Privacy Request – [Your Account Username]" in the subject line, along with a clear description of your request and any relevant account reference numbers. This will help our compliance team process your request as quickly as possible.