Privacy Policy

1. Introduction

This Privacy Policy ("Policy") issued by EpicToto ("Company", "We", "Us", or "Our"), the operator of the online betting and gaming platform accessible at https://epictoto.cam (the "Platform"). This Policy governs the collection, use, storage, disclosure, and protection of personal data provided by or collected from users ("Players", "You", or "Your") of the Platform.

By registering an account on the Platform, making a deposit, or otherwise using our services, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein. This Policy should be read in conjunction with our Terms & Conditions and Responsible Gambling Policy.

EpicToto is committed to handling all personal data in accordance with applicable data protection legislation, including principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, including name, contact details, financial information, and device identifiers.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or deletion.
• "Data Controller" means EpicToto, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" means any third party that processes Personal Data on behalf of EpicToto under a written data processing agreement.
• "KYC" means Know Your Customer — the identity verification process required to comply with anti-money laundering (AML) obligations.
• "Cookies" means small text files placed on your device by the Platform for session management, analytics, and functionality purposes.
• "Sensitive Data" means a special category of Personal Data requiring enhanced protection, such as financial account details or government-issued identification documents.

3. Personal Data We Collect

EpicToto collects the following categories of Personal Data from Players:

4. How We Collect Your Data

EpicToto collects Personal Data through the following means:

• Direct collection: Information you provide during account registration, KYC submission, deposit or withdrawal requests, support interactions, and promotional opt-ins.
• Automated collection: Technical data collected automatically when you access the Platform, including via cookies, web beacons, session tracking, and server logs.
• Payment processors: Transaction confirmation data received from approved Malaysian payment partners including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, RHB, and cryptocurrency network confirmations.
• Identity verification providers: Data received from third-party KYC and AML screening services engaged to fulfil our licensing obligations.
• Third-party analytics: Aggregated and anonymised usage data from analytics providers engaged to improve platform performance.

5. Legal Basis for Processing

EpicToto processes Personal Data on the following legal bases:

• Contractual necessity: Processing required to fulfil the agreement between EpicToto and the Player, including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with KYC, AML, and other regulatory requirements imposed by our international licensing authority.
• Legitimate interests: Processing carried out for fraud detection, platform security, responsible gambling monitoring, and service improvement, where these interests are not overridden by your fundamental rights.
• Consent: Processing for marketing communications and certain analytics activities, where we have obtained your explicit and freely given consent. You may withdraw consent at any time without affecting prior lawful processing.

6. How We Use Your Personal Data

EpicToto uses your Personal Data for the following purposes:

6.1 Account & Service Management

6.1.1 To create, maintain, and administer your EpicToto account, verify your identity and age, process deposits and withdrawals in MYR, and deliver the betting and gaming services you have requested.

6.2 KYC & AML Compliance

6.2.1 To verify your identity, age, and the source of deposited funds in compliance with our international licensing obligations. Identity documents are processed solely for this purpose and are not used for marketing or shared with unauthorised parties.

6.3 Payment Processing

6.3.1 To process deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong, RHB, USDT TRC20, BTC, ETH, BNB, and 7-Eleven CLiQ, and to process withdrawals back to verified payment methods. Financial data is encrypted in transit and at rest.

6.4 Responsible Gambling

6.4.1 To monitor account usage for indicators of problem gambling, enforce deposit limits and self-exclusion requests, and fulfil our duty of care to Players under our responsible gambling programme. This monitoring is a core obligation under our licensing terms.

6.5 Security & Fraud Prevention

6.5.1 To detect, investigate, and prevent fraudulent transactions, account abuse, bot activity, and other security incidents that may harm Players or the Platform's integrity.

6.6 Customer Support

6.6.1 To respond to your enquiries, resolve disputes, process complaints, and provide 24/7 live chat and email support. Support communications may be retained for training and quality assurance purposes.

6.7 Marketing Communications

6.7.1 With your prior consent, to send promotional offers, bonus notifications, and service updates via email or in-platform messaging. You may unsubscribe from marketing communications at any time via your account settings or by contacting support. Withdrawal of marketing consent does not affect your account or service access.

7. Data Sharing & Disclosure

EpicToto does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. Personal Data may be disclosed to the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual safeguards:

• Payment processors: Malaysian payment partners (including DuitNow, FPX operators, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, RHB) and cryptocurrency network providers, solely for transaction execution.
• KYC & AML service providers: Third-party identity verification and screening platforms engaged to fulfil our licensing obligations.
• Technology service providers: Cloud hosting, platform infrastructure, cybersecurity, and analytics providers engaged under data processing agreements that restrict use of your data to specified purposes only.
• Regulatory authorities: Our international licensing authority and any competent law enforcement or regulatory body where disclosure is required by law, court order, or to protect the rights and safety of EpicToto or its players.
• Professional advisers: Legal counsel, auditors, or insurers where necessary for the legitimate operation of our business, subject to professional confidentiality obligations.

In all cases, third-party recipients are required to process your data in compliance with applicable data protection standards and solely for the specified purpose of disclosure.

8. Cookies & Tracking Technologies

8.1 The Platform uses cookies and similar tracking technologies to maintain session state, prevent fraud, and understand how Players use the Platform. Cookies do not contain your name, financial details, or government-issued ID number.

8.2 The following categories of cookies are used on the Platform:

• Strictly necessary cookies: Required for the Platform to function. These include session cookies that keep you logged in during your visit. These cannot be disabled without affecting Platform functionality.
• Analytics cookies: Used to collect aggregated, anonymised data about how the Platform is used — pages visited, session duration, device types. This data helps us improve the Platform experience. These are only set with your consent.
• Preference cookies: Used to remember your language and display preferences across sessions.

8.3 You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair your ability to log in or use core Platform features. Disabling analytics cookies will not affect your ability to use the Platform.

9. Data Retention

9.1 EpicToto retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable laws and our licensing obligations.

9.2 Indicative retention periods are as follows:

• Account data and transaction records: Retained for a minimum of 5 years following account closure, in compliance with AML record-keeping requirements under our licensing terms.
• KYC documents: Retained for a minimum of 5 years following the completion of the relevant business relationship, as required by international AML standards.
• Support communications: Retained for up to 3 years for quality assurance and dispute resolution purposes.
• Technical and usage data: Retained for up to 24 months in identifiable form, after which it is anonymised or deleted.
• Marketing consent records: Retained for the duration of your consent and for a period of 2 years following withdrawal, to demonstrate compliance with consent obligations.

9.3 Upon expiry of the applicable retention period, Personal Data will be securely deleted or anonymised in accordance with our data destruction procedures.

10. Data Security

10.1 EpicToto implements technical and organisational security measures appropriate to the risk level of the data processed. These include:

• 256-bit SSL/TLS encryption for all data in transit between your device and the Platform;
• Encryption of sensitive data fields (financial data, KYC documents) at rest in our database systems;
• Role-based access controls limiting staff access to Personal Data on a strict need-to-know basis;
• Regular third-party penetration testing and vulnerability assessments of Platform infrastructure;
• Two-factor authentication (2FA) available to all Players for additional account security;
• Incident response procedures governing detection, containment, and notification in the event of a data breach.

10.2 Notwithstanding these measures, no electronic transmission over the internet or data storage system can be guaranteed to be 100% secure. Players are responsible for keeping their account credentials confidential and for notifying EpicToto immediately of any suspected unauthorised access.

11. Your Data Rights

Subject to applicable law and the legitimate interests of EpicToto (including AML record-keeping obligations that may prevent immediate deletion), you have the following rights in respect of your Personal Data: