Privacy Policy

01 Introduction

NxToto ("NxToto", "we", "us", "our") operates the online betting and live casino platform accessible at nxtoto.cam ("the Platform"). This Privacy Policy describes how NxToto collects, processes, stores, and protects the personal data of individuals ("User", "you", "your") who access or use the Platform.

By registering an account on NxToto or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. This Policy forms part of, and should be read together with, our Terms & Conditions.

We take your privacy seriously. NxToto does not sell personal data to third parties. We collect and process data only for the purposes described in this Policy, and we retain data only for as long as necessary to fulfil those purposes or as required by applicable law.

02 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, contact details, identification numbers, financial data, and online identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Data Controller" — NxToto, as the entity that determines the purposes and means of Processing Personal Data.
• "Data Processor" — a third party that processes Personal Data on behalf of NxToto, subject to contractual data protection obligations.
• "Cookies" — small text files placed on your device by the Platform for session management, analytics, and functionality purposes.
• "KYC" — Know Your Customer verification procedures used to confirm identity, age, and address.
• "AML" — Anti-Money Laundering compliance obligations applicable to financial service operators.

03 Data We Collect

NxToto collects Personal Data from multiple sources in the course of providing its services. The categories of data we collect are set out in the table below:

3.1 Data You Are Not Required to Provide

Certain data fields during registration are optional. Providing optional data may enhance your experience (for example, enabling personalised promotions) but is not a condition of maintaining an Account. Mandatory fields are clearly marked during the registration process.

04 Legal Basis for Processing

NxToto processes your Personal Data on the following legal grounds:

• Contractual necessity — Processing is required to perform our contract with you, including account creation, payment processing, and the delivery of betting and gaming services.
• Legal obligation — Processing is required to comply with applicable laws, including KYC identity verification, AML transaction monitoring, and regulatory reporting obligations.
• Legitimate interests — Processing is carried out for NxToto's legitimate interests, including fraud detection, security monitoring, platform improvement, and responsible gambling analytics, provided these interests are not overridden by your rights.
• Consent — Where you have provided explicit consent, including for direct marketing communications and certain cookie categories. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

05 How We Use Your Data

NxToto uses the Personal Data we collect for the following purposes:

1. Account Management — creating and maintaining your Account, authenticating your identity at login, and processing account closure requests.
2. Payment Processing — facilitating deposits and withdrawals in MYR via DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong, RHB, and other supported Malaysian payment channels.
3. KYC and AML Compliance — verifying identity, age (21+ requirement), residential address, and the source of funds where required by our AML obligations.
4. Customer Support — responding to your enquiries, resolving disputes, and maintaining records of support interactions.
5. Fraud Prevention and Security — detecting, investigating, and preventing fraudulent transactions, bonus abuse, money laundering, and other prohibited activities.
6. Responsible Gambling — monitoring gaming activity to identify indicators of problem gambling and providing appropriate interventions, tools, and support in accordance with our Responsible Gambling Policy.
7. Platform Improvement — analysing usage patterns to improve Platform functionality, user experience, and game offerings.
8. Marketing Communications — sending promotional offers, bonus notifications, and CNY seasonal promotions to users who have opted in to receive such communications.
9. Legal and Regulatory Compliance — meeting our obligations under applicable laws and responding to lawful requests from competent authorities.

06 Data Sharing & Disclosure

NxToto does not sell, rent, or trade your Personal Data to any third party for commercial purposes. We disclose Personal Data only in the following circumstances:

6.1 Service Providers and Data Processors

We engage regulated third-party service providers to assist with the operation of the Platform. These include payment gateway operators (DuitNow, FPX, and e-wallet processors), identity verification and KYC service providers, cloud infrastructure and hosting providers, and customer support platform operators. All Data Processors are bound by written data processing agreements that restrict their use of your data to the specific services they provide to NxToto.

6.2 Legal and Regulatory Disclosure

NxToto may disclose Personal Data to law enforcement agencies, regulatory bodies, or other competent authorities where required to do so by applicable law, court order, or regulatory direction. We will only disclose the minimum data necessary to satisfy such obligations.

6.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of NxToto's business, Personal Data held by NxToto may be transferred to the acquiring entity as part of that transaction. Users will be notified of any such transfer and of any material change in data processing practices that may result.

07 Cookies & Tracking Technologies

NxToto uses cookies and similar tracking technologies on the Platform to ensure functionality, maintain session security, and gather anonymised analytics data. The categories of cookies we deploy are as follows:

• Essential Cookies — strictly necessary for the Platform to function, including session authentication and security tokens. These cannot be disabled without impairing Platform functionality.
• Functional Cookies — remember your preferences such as language settings and responsible gambling limit configurations between sessions.
• Analytics Cookies — collect anonymised data on page visits, session duration, and user flow to help us improve the Platform experience. No personally identifiable information is transmitted through analytics cookies.
• Marketing Cookies — used only where you have provided explicit consent, to tailor promotional communications and measure the effectiveness of marketing campaigns.

You may manage cookie preferences through your browser settings at any time. Disabling non-essential cookies will not affect your ability to access your Account or use core Platform features.

08 Data Retention

NxToto retains Personal Data for as long as is necessary to fulfil the purposes set out in this Policy or as required by applicable legal and regulatory obligations. The following general retention periods apply:

• Account and Identity Data — retained for a minimum of five (5) years after account closure, in compliance with AML and financial record-keeping requirements.
• Transaction Records — retained for a minimum of seven (7) years to satisfy financial regulatory requirements applicable to operators in the jurisdictions where NxToto operates.
• Support Communications — retained for three (3) years from the date of the last interaction, or longer where the communication is relevant to an unresolved complaint or legal matter.
• Marketing Preferences — retained until consent is withdrawn, plus a further six months to allow for processing and audit purposes.
• Analytics Data — retained in anonymised or aggregated form indefinitely; personally identifiable analytics data is purged after twenty-four (24) months.

Following the expiry of applicable retention periods, Personal Data is securely deleted or anonymised in a manner that prevents reconstruction.

09 Data Security

NxToto implements a layered security framework to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the Platform.
• Encryption of sensitive Personal Data and financial records at rest using industry-standard algorithms.
• Role-based access controls limiting staff access to Personal Data on a strict need-to-know basis.
• Multi-factor authentication for internal systems processing Personal Data.
• Regular penetration testing and vulnerability assessments of Platform infrastructure.
• Incident response procedures for detecting, containing, and reporting data security breaches.

In the event of a data breach that poses a significant risk to your rights and freedoms, NxToto will notify affected users without undue delay and will take all reasonable steps to mitigate harm.

10 Your Rights

Subject to applicable law and any overriding legal retention obligations, you hold the following rights in relation to your Personal Data held by NxToto:

11 Children & Minors

NxToto is strictly an adult platform. Access to and use of the Platform is prohibited for individuals under 21 years of age. NxToto does not knowingly collect Personal Data from persons under the age of 21.

If NxToto becomes aware that Personal Data has been collected from an individual who is under 21 years of age, that data will be deleted immediately and the associated Account will be suspended without notice. Any funds deposited by an underage user will be returned in accordance with applicable law.

Parents and guardians who have reason to believe that a minor under their care has provided Personal Data to NxToto are encouraged to contact our support team immediately at [email protected].

12 International Data Transfers

NxToto's primary operations serve Malaysian users, and we endeavour to store and process Personal Data within data centres located in jurisdictions with adequate data protection standards. Where it is necessary to transfer Personal Data to a jurisdiction outside Malaysia — for example, to a cloud infrastructure provider or KYC service provider operating internationally — NxToto ensures that appropriate safeguards are in place prior to any such transfer.

Appropriate safeguards may include contractual data transfer agreements, binding corporate rules, or other mechanisms recognised as providing an equivalent level of data protection to that applicable in Malaysia. You may request information about the specific safeguards applicable to any international transfer of your data by contacting our support team.

13 Policy Amendments

NxToto reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. Material amendments will be communicated to registered users via a prominent notice on the Platform and, where reasonably practicable, by email to your registered address, no fewer than fourteen (14) days prior to the amendment taking effect.

The effective date at the top of this Policy indicates when the current version came into force. Archived versions of this Policy are available on request. Your continued use of the Platform following notification of any amendment constitutes acceptance of the revised Policy. If you do not agree with any amendment, you should cease using the Platform and request Account closure before the amendment's effective date.

14 Contact & Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or NxToto's data processing practices, please contact our Data Privacy team through the following channels:

• Email: [email protected] — please include "Privacy Request" in the subject line.
• Live Chat: Available 24 hours a day, 7 days a week via the Platform. Please state that your enquiry relates to a privacy matter.

NxToto aims to acknowledge all privacy-related requests within 5 business days and to provide a substantive response within 30 calendar days of receiving a complete and valid request. Where a request is complex or involves a large volume of data, we may extend this period by a further 30 days and will notify you accordingly.