TotoSaja is committed to protecting the privacy and personal data of every user on our platform. This Privacy Policy explains what data we collect, why we collect it, how we use and store it, and what rights you hold as a data subject. Please read this document carefully before using any TotoSaja service.
These cards summarise our core privacy commitments. They do not replace the full legal text below β please read all clauses carefully.
TotoSaja does not sell, rent, or trade your personal data to unaffiliated third parties for their own marketing or commercial purposes. Your data is used only to operate and improve our platform and to meet our compliance obligations.
All personal data stored by TotoSaja is protected using industry-standard 256-bit SSL encryption. Access to personal data is restricted to authorised personnel on a strict need-to-know basis, with multi-layer authentication controls in place.
You have the right to access, correct, and request deletion of your personal data held by TotoSaja, subject to our legal retention obligations. Submit a request to our support team at any time and we will respond within 30 days.
TotoSaja does not store complete payment credentials. Transactions via Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, DuitNow, FPX, and cryptocurrency channels are processed through certified third-party payment gateways subject to their own security standards.
TotoSaja uses cookies and similar tracking technologies solely to maintain session state, remember preferences, and analyse aggregate platform usage. We do not use cookies to build advertising profiles for third-party networks. You may manage cookie preferences through your browser settings.
In the event of a data security breach that materially affects your personal data, TotoSaja will notify affected users as soon as reasonably practicable and in accordance with applicable legal obligations. We maintain an internal incident response protocol reviewed regularly.
This Privacy Policy ("Policy") describes how TotoSaja ("we", "us", "our"), operating the online casino and sports betting platform accessible at totosaja.cam, collects, uses, stores, discloses, and otherwise processes the personal data of individuals ("you", "your", "the User") who visit our website or use our services.
TotoSaja operates primarily within the Malaysian market, serving players across Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and all other states and territories of Malaysia. We take the protection of your personal data seriously and are committed to handling it with transparency, integrity, and appropriate technical safeguards.
This Policy is incorporated by reference into our Terms & Conditions. By creating an account or using any TotoSaja service, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.
Note: If you do not agree to the terms of this Privacy Policy, you must not use the TotoSaja platform. Continued use of the Platform following any amendment to this Policy constitutes acceptance of the revised Policy.
For the purposes of this Privacy Policy, the following definitions apply:
TotoSaja collects the following categories of personal data, depending on how you interact with the Platform:
| Category | Specific Data Points | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, nationality, government-issued ID number (e.g., MyKad, passport) | At registration and KYC verification |
| Contact Data | Email address, mobile phone number, residential address (state/city in Malaysia) | At registration and account updates |
| Financial Data | Payment method type (e.g., Touch 'n Go, Maybank, DuitNow, USDT TRC20), transaction amounts in MYR, deposit and withdrawal history | At each financial transaction |
| Gaming & Betting Data | Bet history, game session data, wagered amounts, win/loss records, bonus usage | During active use of Platform services |
| Technical Data | IP address, device type, operating system, browser type and version, referral URL, session timestamps | Automatically upon Platform access |
| Communications Data | Live chat transcripts, support ticket content, email correspondence with TotoSaja | When you contact our support team |
| Verification Documents | Copies of identity documents, proof of address, source-of-funds documentation submitted during KYC | Upon request during KYC or enhanced verification |
TotoSaja collects personal data through the following mechanisms:
When you register an account, complete a deposit or withdrawal transaction, contact our customer support team (via live chat, WhatsApp, or email), respond to a survey, or participate in a promotion, you provide personal data directly to us.
When you access and use the Platform, we automatically collect certain technical and behavioural data through server logs, cookies, and similar technologies. This includes your IP address, device identifiers, session duration, pages visited, and in-platform actions (e.g., games played, bets placed).
We may receive personal data about you from third-party service providers including identity verification agencies, fraud prevention services, and payment processors. We may also receive data from publicly available sources where relevant to our compliance obligations.
TotoSaja processes your personal data for the following purposes:
TotoSaja processes your personal data on the following legal bases:
TotoSaja does not sell, rent, or otherwise transfer your personal data to unaffiliated third parties for their own independent commercial purposes. We may share your personal data with the following categories of third parties, strictly as necessary to operate the Platform or to comply with legal obligations:
Transaction data is shared with our certified payment gateway partners to facilitate deposits and withdrawals. These partners include providers operating the Touch 'n Go eWallet, Boost, GrabPay, FPX, DuitNow, and cryptocurrency processing infrastructure. Each partner is contractually bound to process your data only as instructed by TotoSaja and in accordance with applicable data protection standards.
TotoSaja engages third-party identity verification and fraud detection agencies to assist with KYC processes. These providers may receive copies of identity documents and relevant account data solely for the purpose of conducting verification checks and fraud risk assessments.
TotoSaja may disclose your personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities where required to do so by applicable law, court order, or in connection with the prevention and investigation of fraud, money laundering, or other criminal activity.
In the event of a merger, acquisition, or sale of all or a material portion of TotoSaja's business assets, personal data held by TotoSaja may be transferred to the acquiring entity as part of that transaction. Users will be notified of any such transfer and any change in data controller identity prior to the transfer taking effect, where reasonably practicable.
TotoSaja retains personal data for as long as is necessary to fulfil the purposes described in this Policy, to maintain your active account, or to comply with applicable legal and regulatory retention obligations.
In practice, this means:
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be associated with any identifiable individual.
TotoSaja uses cookies and similar technologies (including local storage objects and session identifiers) to operate the Platform effectively and to understand how users interact with our services.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Required for the Platform to function β maintains your login session, cart state, and security tokens. Cannot be disabled without breaking core functionality. | Session / up to 24 hours |
| Functional | Remembers your language preferences, display settings, and responsible gambling limit configurations. | Up to 12 months |
| Analytics | Collects anonymised data on page views, session duration, and navigation paths to help us improve the Platform. No personally identifiable data is transmitted to analytics providers. | Up to 24 months |
TotoSaja does not use cookies to build advertising profiles for third-party ad networks or to track your activity across unrelated websites. You may manage or delete cookies through your browser settings at any time. Note that disabling strictly necessary cookies may impair your ability to use the Platform.
TotoSaja implements and maintains appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include:
Notwithstanding the above, no method of electronic transmission or storage is completely secure. While TotoSaja takes all reasonable steps to protect your data, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us immediately if you suspect any unauthorised access to your account.
As a data subject, you hold the following rights with respect to your personal data processed by TotoSaja. To exercise any of these rights, please contact our support team using the details in Section 15. We will respond to all valid requests within thirty (30) days of receipt.
You may request a copy of the personal data TotoSaja holds about you, together with information about how it is processed.
You may request that we correct any inaccurate or incomplete personal data held about you without undue delay.
You may request deletion of your personal data where it is no longer necessary, subject to overriding legal retention obligations.
You may request that we limit how we use your data while a correction or objection request is being assessed.
You may object to processing based on legitimate interests, including direct marketing. We will cease such processing unless we demonstrate compelling legitimate grounds.
Where technically feasible, you may request a copy of your personal data in a structured, machine-readable format for transfer to another service.
Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time without affecting prior processing.
If you believe your data rights have been violated, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.
TotoSaja's services are strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a person under 21, we will take immediate steps to delete that data and close the associated account.
If you are a parent or guardian and believe your child has provided personal data to TotoSaja, please contact us immediately at [email protected] so we can investigate and take appropriate action.
Age Verification: TotoSaja conducts age verification as part of our KYC process for all registered users. We reserve the right to request documentary proof of age at any time, including government-issued identification such as a Malaysian MyKad or passport.
The TotoSaja Platform may reference or integrate with third-party services β including payment providers such as Touch 'n Go eWallet, Boost, GrabPay, Maybank, and CIMB β solely to facilitate the payment functionality described in our Terms & Conditions.
TotoSaja is not responsible for the privacy practices of any third-party service provider. Once you leave the TotoSaja Platform and interact directly with a third-party service, the third party's own privacy policy and terms will govern the handling of your data. We encourage you to review the privacy policies of any third-party services you use in connection with your TotoSaja account.
TotoSaja reserves the right to amend, update, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform functionality. Where changes are material, we will endeavour to provide reasonable advance notice by publishing an update notice on the Platform or by notifying you via your registered email address.
The "Last Updated" date at the top of this Policy will be revised accordingly on each update. Your continued use of the Platform following the publication of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to any amendment, you must cease using the Platform and may request account closure by contacting our support team.
If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data by TotoSaja, please contact our Data Protection team using the following details:
Support & Data Enquiries (plain text β not a link):
Live Chat:
Available directly on the TotoSaja Platform β 24 hours a day, 7 days a week. Languages: English, Bahasa Melayu, δΈζ. Average response time: 3β5 minutes.
Response Time for Data Requests:
We aim to respond to all data subject access requests, correction requests, and deletion requests within 30 calendar days of receipt. Where a request is complex or we have received a high volume, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.
Your privacy is protected, your data stays secure, and your rights are respected. TotoSaja offers live casino, sports betting, and hundreds of slots β backed by fast DuitNow payouts, 24/7 multilingual support, and a platform built for Malaysian players. For players aged 21 and above only.
Play responsibly. 21+ only. | Responsible Gambling Resources | Terms & Conditions