Please read this policy carefully. By creating a TotoXL account, depositing funds, or using any feature of the platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this document, you should discontinue use of TotoXL.
1 Introduction and Definitions
TotoXL ("the Platform", "we", "us", "our") is an online sports betting and live casino service designed for eligible adult players, including users based across Malaysia — from Kuala Lumpur, Penang, and Johor Bahru to Petaling Jaya, Shah Alam, and beyond. This Privacy Policy governs the collection, processing, storage, and disclosure of personal data obtained through use of the TotoXL website and any associated services.
Definitions Used in This Policy
- Personal Data — any information relating to an identified or identifiable natural person, including but not limited to names, identification numbers, contact details, financial records, and device identifiers.
- Processing — any operation performed on personal data, whether or not by automated means, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
- Data Controller — TotoXL, which determines the purposes and means of processing personal data collected through the platform.
- Data Subject — the individual to whom personal data relates; in the context of TotoXL, this primarily refers to registered players and prospective players.
- Third-Party Processor — an entity that processes personal data on TotoXL's behalf pursuant to a written agreement, such as payment providers, KYC verification services, and fraud detection partners.
This Privacy Policy is to be read alongside the TotoXL Terms & Conditions and Responsible Gambling policy. Together, these documents form the complete framework governing your relationship with the platform.
2 Data We Collect
TotoXL collects personal data through several channels: registration forms, KYC verification submissions, payment transactions, platform usage, customer support interactions, and passive technical means. The categories of data we process are described below.
Registration and Identity Data
When you open a TotoXL account, we collect your full name, date of birth, email address, phone number, residential address, and the credentials you choose for authentication. For Malaysian players, this typically aligns with details recorded on your MyKad or other valid government-issued identification.
Identity Verification (KYC) Data
To comply with our licensing obligations and prevent fraud and underage gambling, TotoXL may request copies of your MyKad, driving licence, passport, utility bills, bank statements, or live selfie verification. These documents are processed by our KYC partners under strict confidentiality and access controls.
Financial and Transaction Data
We record details of all deposits, withdrawals, and wagers made through TotoXL. This includes payment method identifiers (e.g., Touch 'n Go eWallet reference, DuitNow account, Maybank account suffix, CIMB reference, FPX transaction ID, cryptocurrency wallet address), amounts in MYR or equivalent, timestamps, and processing outcomes. We do not store full card numbers or full bank account numbers on our servers.
Usage and Behavioural Data
We collect data about how you interact with TotoXL, including pages visited, betting markets viewed, games played, session durations, search queries within the platform, device type, operating system, browser version, IP address, and approximate geolocation derived from your IP. This data helps us improve the platform experience and identify unusual access patterns that may indicate fraud or account compromise.
Support and Communications Data
When you contact TotoXL support via live chat, email, or any other channel, we retain records of those communications. This includes your account details, the nature of the inquiry, any attachments provided, and the support team's response. These records are maintained for quality assurance, compliance, and dispute resolution purposes.
3 Legal Basis for Processing
TotoXL processes personal data on one or more of the following legal bases, depending on the nature of the processing activity:
| Processing Activity |
Legal Basis |
| Account registration and operation |
Contractual necessity — required to provide the TotoXL service |
| KYC identity verification |
Legal obligation — mandatory under licensing framework |
| Payment processing and fraud prevention |
Contractual necessity and legitimate interest |
| Responsible gambling monitoring |
Legal obligation and legitimate interest |
| Promotional communications |
Consent — you may withdraw at any time |
| Platform analytics and improvement |
Legitimate interest in improving service quality |
| Legal and regulatory reporting |
Legal obligation — compliance with applicable requirements |
4 How We Use Your Data
TotoXL uses the personal data described above for the following purposes:
- Creating, maintaining, and securing your TotoXL account, including processing login and two-factor authentication.
- Verifying your identity and age (21+) before enabling full platform access and before releasing withdrawals.
- Processing deposits made via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, and cryptocurrency methods, and disbursing your winnings through the same channels.
- Settling sports wagers across EPL, Liga Super Malaysia, UFC, and other covered markets, and resolving disputes relating to game outcomes.
- Monitoring for fraud, money laundering, account abuse, and responsible gambling concerns in accordance with our obligations.
- Sending service-essential communications, including deposit confirmations, withdrawal updates, and security alerts.
- Sending promotional communications regarding TotoXL bonuses, VIP programme updates, and new product features, where you have provided consent or where we have a legitimate interest.
- Improving platform performance, fixing technical issues, and developing new features based on aggregated usage analysis.
- Complying with requests from regulatory authorities, courts, and law enforcement agencies where required by applicable law.
5 Sharing and Disclosure
TotoXL does not sell your personal data to third parties. We may share data with the following categories of recipients under strict data processing agreements or as required by law:
Payment Processors and Financial Institutions
Payment data is shared with Malaysian payment networks (including FPX, DuitNow, and e-wallet operators) and banking partners necessary to complete deposits and withdrawals. Each processor operates under its own data protection obligations.
KYC and Fraud Prevention Partners
Identity documents and verification data may be processed by accredited third-party KYC service providers and fraud detection systems. These providers act solely as data processors on TotoXL's instructions.
Game Content Providers
Licensed international game studios supplying slot, live dealer, and sports content to TotoXL may receive your session token and stake data to facilitate gameplay. Game providers do not receive your full personal profile and are contractually restricted from using such data for their own purposes.
Legal and Regulatory Disclosures
TotoXL may disclose personal data to regulators, licensing authorities, law enforcement agencies, courts, or professional advisors where required by a binding legal obligation or to protect the rights and safety of TotoXL, its players, or the public. We will notify you of such disclosures where permitted to do so.
Business Transfers
In the event of a merger, acquisition, restructuring, or sale of TotoXL or its assets, personal data held about registered players may be transferred to the acquiring entity. Players will be notified of any material change in data controller prior to its taking effect.
6 Retention Periods
TotoXL retains personal data for the period necessary to fulfil the purpose for which it was collected, to satisfy our legal obligations, resolve disputes, and enforce agreements. Where data is no longer required, it is securely deleted or anonymised.
- Account data — retained for the duration of the account plus a post-closure period of up to 5 years to meet regulatory and anti-money-laundering requirements.
- KYC documents — retained for a minimum of 5 years from the date of verification or account closure, whichever is later, in accordance with applicable licensing obligations.
- Transaction records — retained for a minimum of 5 years to support audit, dispute resolution, and legal compliance obligations.
- Support communications — retained for up to 3 years following the resolution of the relevant inquiry, or longer where a related dispute remains open.
- Marketing consent records — retained for 3 years from the date of the most recent interaction, or until consent is withdrawn.
- Analytics and session logs — retained in anonymised or aggregated form indefinitely for statistical and platform improvement purposes.
7 Cookies and Tracking Technologies
TotoXL uses cookies and similar tracking technologies to maintain your session, remember preferences, detect fraud, and analyse platform performance. The categories of cookies we use are:
Strictly Necessary Cookies
These cookies are essential to core platform functionality, including user authentication, session management, and security token validation. They cannot be disabled without impairing core services.
Analytical and Performance Cookies
We use anonymised analytics data to understand how Malaysian players navigate TotoXL, which markets and games are most popular, and where technical errors may occur. This data is aggregated and does not identify individual users.
Functional Cookies
Functional cookies remember choices you have made on TotoXL — such as preferred odds format, currency display, and responsible gambling limit settings — so that they persist across sessions without requiring repeated input.
Managing Cookie Preferences
You may configure your browser to block or delete cookies at any time. Please note that disabling strictly necessary cookies will affect your ability to log into and use TotoXL. For analytical and functional cookies, a cookie management interface may be accessible via your account settings.
8 Security Measures
TotoXL implements and maintains a range of technical and organisational security measures proportionate to the sensitivity of the data we hold:
- Transport Layer Security (TLS 1.2+): All data exchanged between your browser and TotoXL servers is encrypted in transit.
- At-Rest Encryption: Sensitive personal data and financial records stored in TotoXL databases are encrypted using industry-standard algorithms.
- Access Controls: Staff access to personal data is role-based and governed by the principle of least privilege. Access to KYC documents is restricted to authorised compliance personnel.
- Two-Factor Authentication (2FA): Players are encouraged to enable 2FA on their TotoXL accounts. 2FA is mandatory for certain high-value or sensitive account actions.
- Fraud Monitoring: Automated systems monitor for unusual login patterns, payment anomalies, and suspicious betting behaviour that may indicate account compromise.
- Penetration Testing: TotoXL conducts periodic security assessments to identify and remediate vulnerabilities before they can be exploited.
While TotoXL takes all reasonable steps to protect your data, no system is entirely immune from breach. In the event of a material security incident affecting your personal data, TotoXL will notify affected players and relevant authorities in accordance with applicable requirements.
9 Your Data Rights
Subject to applicable law and our legitimate operational and legal obligations, TotoXL recognises and will endeavour to honour the following rights in respect of your personal data:
Right of Access
Request a copy of the personal data TotoXL holds about you and information on how it is processed.
Right to Rectification
Request correction of inaccurate or incomplete personal data held in your TotoXL account.
Right to Erasure
Request deletion of your personal data, subject to our legal and regulatory retention obligations.
Right to Restrict Processing
Request that TotoXL limits processing of your data in certain circumstances, such as while a dispute is under review.
Right to Data Portability
Request your personal data in a structured, machine-readable format where processing is based on consent or contract.
Right to Object
Object to processing carried out on the basis of legitimate interest, including direct marketing communications.
To exercise any of the above rights, contact our support team through live chat or by sending a written request to the email address displayed at the bottom of this page. We will acknowledge your request within 5 business days and aim to respond substantively within 30 calendar days. Verification of your identity will be required before any data is disclosed or deleted.
10 Minors and Age Enforcement
TotoXL is strictly prohibited for persons under the age of 21. We do not knowingly collect personal data from individuals below this age threshold. Age is verified during the KYC process and may be re-verified at any point during the account lifecycle.
If TotoXL identifies or is credibly informed that an account belongs to a person under 21, the account will be suspended immediately, all wagers placed by the account will be voided, and any deposits will be returned to the depositing payment method following verification. The personal data collected will be retained only for the minimum period necessary to complete this remediation process and comply with any reporting obligations, after which it will be securely deleted.
Parents and guardians who are concerned that a minor in their household may have accessed TotoXL should contact our support team immediately and use the platform's self-exclusion and account restriction tools available on the Responsible Gambling page.
11 Changes to This Privacy Policy
TotoXL may update this Privacy Policy to reflect changes in our data processing practices, the services we offer, applicable legal or regulatory requirements, or feedback received from players. The updated policy will be published on this page with a revised effective date.
Where a change is material — for example, a new category of data being collected, a new purpose for which data is used, or a new third-party recipient being introduced — TotoXL will take reasonable steps to notify registered players via email or an in-platform notification before the change takes effect. Continued use of TotoXL after the effective date of a revised policy constitutes acceptance of the changes.
We encourage you to revisit this page periodically and to review the effective date at the top of this document to ensure you are reading the most current version of the Privacy Policy.
12 Contact Us
If you have questions, concerns, or requests relating to this Privacy Policy or TotoXL's handling of your personal data, please use one of the following contact channels:
- 24/7 Live Chat: Accessible directly from any page on the TotoXL platform. Fastest channel for time-sensitive data requests.
- Email (plain text — not a link): [email protected]
For further information about your rights and the governance of your account, you may also refer to:
TotoXL takes all privacy inquiries seriously. Our team will acknowledge receipt within 5 business days and aim to provide a substantive response within 30 calendar days of receiving a fully identified and documented request.