Privacy Policy

1.1 toto20 is committed to protecting the privacy and personal data of all players who use the toto20 platform. This Privacy Policy explains in plain terms what personal information toto20 collects from Pakistani players, why we collect it, how long we keep it, who we share it with, and what rights you have in relation to your personal data.

1.2 toto20 processes personal data in accordance with applicable international data protection frameworks under which the platform operates. Where the laws of Pakistan relating to data protection apply to a specific processing activity concerning a Pakistani player, toto20 will apply those standards to that activity.

1.3 The toto20 platform is intended exclusively for adults aged 18 years and above. toto20 does not knowingly collect personal data from persons under 18. If toto20 becomes aware that personal data has been collected from a minor, that data will be deleted promptly and the associated account suspended.

2.1 For the purposes of this Privacy Policy, toto20 is the data controller in respect of personal data collected through the toto20 platform at toto20.lat.

2.2 If you have any questions, requests, or concerns regarding how toto20 handles your personal data, please contact the toto20 Data Protection contact point at: [email protected]

3.1 toto20 collects personal data from Pakistani players through the following channels: account registration, KYC verification, payment processing, platform usage, customer support interactions, and automated technical collection via cookies and server logs.

3.2 The categories of personal data toto20 collects include:

3.3 toto20 does not collect sensitive personal data beyond what is strictly required for identity verification and regulatory compliance. toto20 does not collect biometric data other than selfie photographs submitted for KYC liveness checks.

4.1 toto20 uses personal data collected from Pakistani players for the following purposes:

• Account Administration: Creating and managing your toto20 player account, verifying your identity, and maintaining account security.
• KYC and Age Verification: Confirming that you are 18 or older and that the account belongs to the person identified during registration, as required for toto20's regulatory compliance obligations.
• Payment Processing: Processing deposits via JazzCash, Easypaisa, HBL, UBL, Meezan Bank, Bank Alfalah, or international methods, and processing withdrawal requests to verified payment instruments.
• Platform Delivery: Providing access to toto20's games, cricket betting markets, live casino, and all other entertainment products on the platform.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, money laundering, multi-account abuse, and other prohibited conduct on the toto20 platform.
• Responsible Gaming: Monitoring gaming activity patterns to identify potential problem gambling indicators, enforcing player-set limits, and administering self-exclusion arrangements.
• Customer Support: Responding to enquiries, resolving disputes, and administering support requests from Pakistani players.
• Legal and Regulatory Compliance: Fulfilling obligations under applicable international gaming regulations, anti-money laundering requirements, and data protection laws that apply to toto20's operations.
• Platform Improvement: Analysing aggregated and anonymised usage data to improve the toto20 platform experience for Pakistani players.
• Communications: Sending account-related transactional communications (deposit confirmations, withdrawal notifications, security alerts) and, where consent has been given, promotional communications.

4.2 toto20 will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or establishing a separate legal basis for that use.

5.1 toto20 processes personal data on the following legal bases:

• Contractual Necessity: Processing required to perform the contract established by the toto20 Terms & Conditions — including account management, payment processing, and game delivery.
• Legal Obligation: Processing required for compliance with applicable regulatory requirements, including KYC, anti-money laundering obligations, and regulatory reporting.
• Legitimate Interests: Processing necessary for toto20's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and platform improvement — provided these interests are not overridden by your rights and interests.
• Consent: Where toto20 relies on your consent as a legal basis — for example, for sending promotional communications — you may withdraw that consent at any time by contacting toto20 support.

6.1 toto20 does not sell, rent, or trade your personal data to third parties. toto20 shares personal data only in the following circumstances:

• Payment Processors: JazzCash, Easypaisa, and other supported payment service providers receive the minimum financial data necessary to process your deposit or withdrawal transaction.
• KYC / Identity Verification Providers: Third-party identity verification services may process your KYC documents on toto20's behalf under data processing agreements that bind them to equivalent data protection standards.
• Game Providers: toto20's third-party game providers may receive anonymised or pseudonymised session data necessary to deliver games. These providers do not receive your identity data unless required for game-specific compliance.
• Regulatory Authorities: Where required by applicable law or regulatory obligation, toto20 may disclose personal data to relevant authorities. Such disclosures will be limited to what is strictly required.
• Legal Proceedings: toto20 may disclose personal data in connection with legal proceedings, court orders, or when necessary to protect the rights and safety of toto20, its players, or the public.
• Corporate Transactions: In the event of a merger, acquisition, or sale of all or part of toto20's business, player personal data may be transferred to the acquiring entity, subject to equivalent privacy commitments.

6.2 All third parties that process personal data on toto20's behalf are required to maintain appropriate technical and organisational security measures and to process personal data only as instructed by toto20.

7.1 toto20 uses cookies and similar tracking technologies to operate and improve the platform. The following types of cookies are used:

• Strictly Necessary Cookies: Required for core toto20 platform functions including login session management, security token validation, and payment flow state. These cookies cannot be disabled without breaking core platform functionality.
• Functional Cookies: Used to remember your preferences — such as language settings and responsible gaming limit configurations — across toto20 sessions.
• Analytics Cookies: Used to collect aggregated and anonymised information about how Pakistani players use the toto20 platform, enabling toto20 to identify and fix usability issues and improve the player experience.
• Security Cookies: Used to detect and mitigate fraudulent sessions, bot activity, and account takeover attempts on the toto20 platform.

7.2 toto20 does not use third-party advertising cookies or behavioural profiling cookies for the purpose of serving advertisements on external websites.

7.3 You may configure your browser to reject or delete cookies. Note that disabling strictly necessary cookies will impair your ability to log in and use the toto20 platform.

8.1 toto20 retains personal data for as long as necessary to fulfil the purposes set out in this Privacy Policy, and for as long as required by applicable regulatory obligations.

8.2 As a general guide, toto20's data retention periods are as follows:

• Active Account Data: Retained for the duration of the active toto20 account relationship.
• KYC Documents: Retained for a minimum of five (5) years following account closure, in accordance with anti-money laundering regulatory requirements.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction.
• Gaming Activity Records: Retained for a minimum of three (3) years from the relevant activity date.
• Support Communications: Retained for three (3) years from the date of closure of the relevant support interaction.

8.3 Following the expiry of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with any individual.

9.1 toto20 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• HTTPS / TLS encryption for all data transmitted between your device and the toto20 platform
• Encrypted storage of sensitive personal and financial data at rest
• Access controls limiting personal data access to authorised toto20 staff on a need-to-know basis
• Multi-factor authentication requirements for toto20 staff accessing personal data systems
• Regular security assessments and penetration testing of the toto20 platform infrastructure
• Incident response procedures for detecting, investigating, and responding to data security incidents

9.2 While toto20 takes data security seriously, no internet-based platform can guarantee absolute security. Pakistani players are responsible for maintaining the security of their own toto20 login credentials and for enabling two-factor authentication on their accounts.

9.3 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, toto20 will notify affected Pakistani players promptly in accordance with applicable regulatory requirements.

10.1 Subject to applicable law, Pakistani players have the following rights in relation to their personal data held by toto20:

• Right of Access: You may request a copy of the personal data toto20 holds about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data. Note that corrections to KYC data require documentary verification.
• Right to Erasure: You may request deletion of your personal data in certain circumstances. This right does not apply where retention is required by law — for example, KYC and transaction records that toto20 is obligated to retain for regulatory purposes.
• Right to Restrict Processing: You may request that toto20 restrict the processing of your personal data in certain circumstances, for example while a rectification request is being assessed.
• Right to Data Portability: Where processing is based on consent or contract, you may request a structured, machine-readable export of the personal data you have provided to toto20.
• Right to Object: You may object to processing based on toto20's legitimate interests, including direct marketing. Where you object to direct marketing, toto20 will cease that processing immediately.
• Right to Withdraw Consent: Where toto20 processes your data based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

10.2 To exercise any of the above rights, please submit a request to toto20 support at [email protected]. toto20 will respond to verified requests within 30 days. Identity verification may be required before a request is processed.

11.1 toto20 may transfer personal data to and store it on servers located outside Pakistan. Where personal data is transferred to countries that do not provide an equivalent level of data protection, toto20 will implement appropriate safeguards — such as data processing agreements incorporating standard contractual clauses — to ensure that your personal data receives an adequate level of protection.

11.2 By using the toto20 platform, Pakistani players consent to the transfer of their personal data to toto20's servers and authorised processors in accordance with this Privacy Policy.

12.1 The toto20 platform is strictly for adults aged 18 and above. toto20 does not knowingly collect, store, or process personal data from individuals under 18 years of age.

12.2 If toto20 discovers that personal data has been collected from a person under 18, that data will be deleted immediately and the associated toto20 account will be suspended without notice. If you are a parent or guardian and believe that a minor has registered a toto20 account, please contact [email protected] immediately.

13.1 The toto20 platform may contain references to third-party payment processors or game providers in the context of account operations. toto20 is not responsible for the privacy practices of any third-party service whose data processing is not governed by a data processing agreement with toto20.

13.2 This Privacy Policy applies solely to personal data processed by toto20 in connection with the toto20 platform at toto20.lat.

14.1 toto20 reserves the right to amend this Privacy Policy at any time. The "Last Updated" date at the top of this page will be revised with each amendment. Material changes to this Policy will be communicated to registered toto20 players via the platform or by email to the registered account address.

14.2 Your continued use of the toto20 platform following any amendment to this Privacy Policy constitutes your acceptance of the revised Policy. If you do not accept the revised terms, you must stop using the toto20 platform and request account closure.

15.1 For any privacy-related queries, data access requests, or data rectification requests, please contact toto20 at:

Email: [email protected]

15.2 Please include "Privacy Request" in the subject line of your email and provide sufficient identifying information for toto20 to verify your identity before processing your request. toto20 will acknowledge all privacy requests within 5 business days and will aim to resolve requests within 30 days.