At 98toto, protecting your personal data is a responsibility we take seriously. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your own data.
Last Updated: 1 January 2026Our Privacy Commitments
These six principles guide how 98toto handles your personal data. They are not a substitute for reading the full policy — but they reflect the spirit of every decision we make about your privacy.
We collect only the personal data that is genuinely necessary to operate your account, process transactions, conduct KYC verification, and deliver our services. We do not collect information speculatively or without a clear, lawful purpose.
All personal data held by 98toto is stored on secure, access-controlled servers protected by 256-bit SSL/TLS encryption. Payment data processed through Touch 'n Go eWallet, FPX, Maybank, CIMB, and other channels is handled under their respective security standards.
98toto does not sell, rent, or trade your personal information to third-party marketers or data brokers under any circumstances. Your information is used to serve you — not to monetise your profile for others.
We are transparent about what data we collect, why we collect it, and how long we retain it. This Privacy Policy is written in plain English — not dense legalese — so you can make informed decisions about your personal information.
You have the right to access, correct, delete, or restrict the processing of your personal data. You can also object to certain types of processing or request data portability. We honour all valid requests within the timeframes set out in this policy.
98toto processes personal data in accordance with applicable data protection principles and our regulatory obligations, including anti-money laundering (AML) and KYC requirements. We conduct regular internal reviews of our data handling practices.
This Privacy Policy ("Policy") is issued by 98toto ("98toto", "we", "us", "our"), the operator of the online gaming and sports betting platform accessible at https://98toto.lat ("Platform"). This Policy describes how 98toto collects, uses, processes, shares, and protects the personal data of registered users, website visitors, and any other individuals who interact with our Platform or services.
98toto is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection laws and international best practice. We serve players across Malaysia — including Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and Shah Alam — and we recognise the trust each player places in us when they share their personal information to create an account or process a transaction.
By registering an account on the Platform or by continuing to use our services after this Policy has been made available to you, you acknowledge that you have read and understood how your personal data will be processed as described herein. If you do not agree with any aspect of this Policy, you should not create an account or continue using the Platform.
For the purposes of this Privacy Policy, the following terms have the meanings set out below:
98toto collects the following categories of Personal Data in the course of providing its services:
98toto collects Personal Data through the following means:
98toto processes your Personal Data for the following purposes:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation and management | Registration data, KYC data | Contract performance |
| Age verification (21+ requirement) | Date of birth, identity documents | Legal obligation |
| Deposit and withdrawal processing | Financial and transaction data | Contract performance |
| Fraud prevention and AML compliance | Transaction data, IP address, KYC data | Legal obligation / Legitimate interests |
| Customer support delivery | Communications data, account data | Contract performance |
| Responsible gambling monitoring | Betting activity, session data | Legal obligation / Legitimate interests |
| Platform security and abuse prevention | Technical data, usage logs | Legitimate interests |
| Marketing communications (where consented) | Email, phone number, preferences | Consent |
| Analytics and platform improvement | Usage and technical data | Legitimate interests |
We do not use your Personal Data to make fully automated decisions that produce legal or similarly significant effects without human review, except in limited fraud detection circumstances where automated checks are a necessary first step prior to human assessment.
98toto processes Personal Data on the following legal bases:
98toto does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. We share Personal Data only in the following limited circumstances:
We engage third-party service providers who process Personal Data on our behalf, under strict contractual data processing agreements. These include payment processors (Touch 'n Go, FPX network, cryptocurrency processors), identity verification providers, cloud hosting infrastructure, customer support platforms, and analytics services. All processors are contractually bound to use your data only for the specified purpose and to maintain appropriate security standards.
We may disclose Personal Data to regulatory authorities, law enforcement agencies, or courts where required by applicable law, court order, or where we have a good-faith belief that such disclosure is necessary to prevent fraud, money laundering, terrorist financing, or other illegal activity. We will endeavour to notify you of any such disclosure to the extent permitted by law.
In the event of a merger, acquisition, restructuring, or sale of all or part of 98toto's business assets, Personal Data may be transferred to the relevant acquiring entity as part of that transaction, subject to equivalent data protection commitments being maintained.
98toto uses cookies and similar tracking technologies to operate essential Platform functions, remember your preferences, analyse usage patterns, and support our fraud prevention systems.
You can manage and restrict cookie settings through your browser settings. Note that disabling essential cookies may prevent you from logging in or using key Platform functions. Analytics and functional cookies can typically be disabled without affecting core account access. Our Platform may display a cookie consent notice when you first visit.
98toto retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations.
Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where anonymisation is applied, the resulting data may be retained indefinitely for statistical and research purposes, as it no longer constitutes Personal Data.
98toto implements a comprehensive set of technical and organisational security measures designed to protect your Personal Data against unauthorised access, accidental loss, disclosure, alteration, or destruction. Our security infrastructure includes:
While we employ robust security measures, no online platform can guarantee absolute security. You are also responsible for keeping your account credentials confidential and for notifying us immediately if you suspect any unauthorised access.
Subject to applicable law and certain exceptions, you have the following rights in respect of your Personal Data held by 98toto:
To exercise any of these rights, please contact us via live chat or by email at [email protected] (plain text — not a link). We will respond to all valid requests within 30 days. In complex cases, we may extend this period by up to a further 60 days, in which case we will notify you of the extension and the reason for it.
The 98toto Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect Personal Data from any person under the age of 21. Our registration process includes mandatory date of birth collection, and age verification is required before an account can be fully activated.
If we become aware that Personal Data has been collected from a person under the age of 21 — whether through registration, KYC review, or any other means — we will immediately suspend the relevant account, void any associated transactions and winnings, and permanently delete all Personal Data associated with that account, subject to any overriding legal retention obligation.
If you are a parent or guardian and believe your child may have registered or attempted to register on the Platform, please contact our support team immediately via live chat or email so we can investigate and act swiftly.
As an online platform serving Malaysian players, 98toto's primary data processing infrastructure is located in jurisdictions that maintain appropriate data protection standards. In some cases, Personal Data may be transferred to and processed in countries outside Malaysia — for example, where cloud hosting infrastructure or third-party service providers are located internationally.
Where such transfers occur, we ensure that appropriate safeguards are in place, including contractual protections requiring the receiving party to process your data in accordance with standards equivalent to those set out in this Policy. By using the 98toto Platform, you acknowledge and consent to such transfers where they are necessary for the provision of our services.
The 98toto Platform may reference or interact with third-party services, including payment providers such as Touch 'n Go eWallet, Boost, GrabPay, and banking institutions including Maybank, CIMB, Public Bank, and Hong Leong Bank. Once you leave the 98toto Platform to transact with these providers, your data is subject to their respective privacy policies, which we encourage you to review.
98toto is not responsible for the privacy practices of any third-party service providers. The inclusion of references to third-party payment brands or services does not constitute an endorsement of their privacy practices.
98toto reserves the right to update or modify this Privacy Policy at any time. Where changes are material — that is, where they significantly affect how we process your Personal Data or your rights — we will provide reasonable advance notice via email or a prominent notice on the Platform prior to the changes taking effect.
Minor or administrative amendments may be made without individual notification, but the revised Policy will always be accessible on this page with an updated "Last Updated" date at the top. Your continued use of the Platform following the publication of any revised Policy constitutes your acknowledgement of and agreement to the updated terms.
We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your Personal Data by 98toto, please contact our Data Protection team through the following channels:
We will acknowledge all data rights requests within 5 business days and provide a substantive response within 30 days. For complex requests, we may extend this to 90 days, in which case we will notify you promptly.
If you are not satisfied with our response to your privacy concern, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.
We're Here to Help
Our support team handles data rights requests and privacy queries 24 hours a day. If you'd like to exercise any of your rights, or simply want to understand how your data is used, we're just a message away.
For players aged 21 and above only. By using 98toto, you consent to the processing of your data as described in this Privacy Policy.