Privacy Policy

RRToto ("we", "us", "our", or "the Platform") operates the online gaming website accessible at rrtoto.asia. We act as the data controller in respect of personal information collected through your use of this Platform. This Privacy Policy describes our practices with respect to the collection, use, storage, disclosure, and protection of personal data pertaining to our users, including registered players and visitors to the site.

We are committed to handling personal data responsibly, transparently, and in a manner consistent with applicable data protection principles. By accessing or using the RRToto Platform — whether as a registered player or an unregistered visitor — you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy should be read in conjunction with our Terms & Conditions, which together govern your relationship with RRToto. In the event of any conflict between this Policy and the Terms & Conditions on matters of data protection, this Privacy Policy shall prevail.

The following terms carry the meanings set out below throughout this Privacy Policy:

RRToto collects Personal Data across several categories depending on the nature of your interaction with the Platform. The specific data collected is as follows:

RRToto collects Personal Data through the following channels and mechanisms:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal request, contact customer support, or participate in a promotional offer.
• Automatically through the Platform — via cookies, web beacons, server logs, and similar technologies that record your interactions with the Platform, including pages visited, games played, and session timing.
• From payment service providers — when you conduct transactions via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, or Hong Leong Connect, your payment provider may share transaction confirmation data and reference identifiers with RRToto for reconciliation purposes.
• From fraud prevention and identity verification services — third-party KYC verification tools may provide data signals to supplement the documents you submit directly, for the purpose of verifying authenticity and detecting fraud.
• From other players, in limited circumstances — where a player refers you via the Refer a Friend programme, we receive your contact information from the referring player. This data is used solely for the purpose of processing the referral and is not used for marketing without your separate consent.

RRToto processes Personal Data on the following legal bases, which vary depending on the purpose and nature of the processing activity:

• Contractual necessity: Processing required to fulfil our contractual obligations to you as a registered player — including account management, processing deposits and withdrawals, settling bets, and providing customer support.
• Legal obligation: Processing required to comply with applicable laws and regulatory requirements, including anti-money laundering (AML) obligations, counter-terrorism financing (CTF) rules, KYC verification mandates, and age verification requirements.
• Legitimate interests: Processing carried out in pursuit of RRToto's legitimate business interests, including fraud prevention, platform security, abuse detection, and service improvement analytics — where such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily in the context of direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

RRToto uses collected Personal Data for the following specific purposes. We do not use your data for any purpose that is incompatible with the purposes described below without first seeking your consent:

• Account creation and management — to set up, maintain, and administer your registered player account, including processing login credentials, managing account settings, and enabling KYC-verified withdrawal access.
• Transaction processing — to process deposits via Malaysian payment methods (Touch 'n Go eWallet, DuitNow, FPX, etc.), settle winning wagers, and execute withdrawal requests to your verified payment account.
• Identity and age verification — to verify that you are who you claim to be and that you meet the Platform's minimum age requirement of 21 years, in compliance with applicable regulatory standards.
• AML and fraud prevention — to monitor transactions and account activity for indicators of money laundering, fraud, account sharing, or other prohibited conduct as defined in our Terms & Conditions.
• Customer support — to respond to your enquiries, resolve disputes, process complaints, and maintain a record of communications for quality assurance and audit purposes.
• Responsible gambling management — to administer deposit limits, self-exclusion periods, cooling-off requests, and session time reminders you have set, and to proactively identify patterns of play that may indicate problem gambling.
• Marketing and personalisation (with consent) — to send you promotional communications, bonus offers, and platform updates by email or in-platform notification, where you have consented to receive such communications. You may opt out at any time.
• Platform analytics and improvement — to analyse aggregated usage data, identify technical issues, improve game performance, and enhance the overall player experience on the Platform.

RRToto does not sell, rent, or trade your Personal Data to third parties for commercial purposes. We share your data only in the limited circumstances described below, and only to the extent strictly necessary for the purpose in question:

• Payment processors and financial institutions — data necessary to process your deposit or withdrawal is shared with the relevant payment service provider (e.g., Touch 'n Go eWallet, Maybank, CIMB, DuitNow network). This is limited to transaction amounts, reference identifiers, and account verification data.
• KYC and identity verification providers — your identity documents and biometric selfie data may be processed by a third-party verification partner solely for the purpose of confirming your identity and age. These providers operate under strict data processing agreements and are prohibited from using your data for any other purpose.
• Fraud prevention and AML screening services — transaction data and account behavioural signals may be shared with specialist fraud prevention services to identify and prevent financial crime.
• Regulatory and law enforcement authorities — we will disclose Personal Data to competent governmental, regulatory, or law enforcement authorities where we are legally required to do so, or where such disclosure is necessary to prevent serious harm or criminal activity.
• IT service providers and infrastructure operators — cloud hosting, data storage, and platform maintenance partners may have incidental access to Personal Data in the course of providing technical services. All such partners are bound by data processing agreements that restrict their use of the data to the specific service provision purpose.

The RRToto Platform uses cookies and similar tracking technologies to support the operation, security, and improvement of the Platform. The categories of cookies we use are as follows:

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will prevent the Platform from functioning correctly. Disabling analytics or functional cookies will not prevent you from using the Platform but may affect the personalisation of your experience.

RRToto retains Personal Data for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, audit, or risk-management obligations. Specific retention periods are as follows:

• Account data and KYC records: Retained for a minimum of five (5) years from the date of account closure or last transactional activity, in compliance with AML record-keeping requirements.
• Transaction records: Retained for a minimum of five (5) years from the date of each transaction, in line with standard financial compliance obligations.
• Customer support communications: Retained for up to three (3) years from the date of the interaction, for audit and dispute resolution purposes.
• Marketing preference records: Retained for the duration of your account relationship, and for a period of twelve (12) months following account closure, to evidence compliance with consent and opt-out records.
• Session and analytics data: Retained in aggregated, anonymised form for up to twenty-four (24) months following collection.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised in a manner that prevents re-identification. Where deletion is not immediately possible due to technical constraints, data will be isolated from active processing until deletion can be completed.

RRToto implements a multi-layered approach to data security, combining technical, organisational, and procedural safeguards designed to protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• Transport Layer Security (TLS/SSL): All data transmitted between your device and the Platform is encrypted using industry-standard 256-bit SSL/TLS encryption. The padlock symbol in your browser confirms an active secure connection at all times.
• Data encryption at rest: Sensitive Personal Data, including KYC documents and financial records, is encrypted when stored within our data infrastructure using strong encryption standards.
• Access controls: Internal access to Personal Data is restricted to authorised personnel on a strict need-to-know basis. All staff with access to player data are subject to confidentiality obligations and receive data protection training.
• Intrusion detection and monitoring: Our systems are monitored continuously for suspicious activity, unauthorised access attempts, and potential data breach indicators.
• Penetration testing: The Platform undergoes periodic security assessments including penetration testing and vulnerability scanning by qualified security professionals.

While RRToto takes all reasonable and appropriate measures to protect your data, no online system or transmission can be guaranteed to be entirely secure. Players are reminded to maintain the security of their own login credentials and to notify support immediately if they suspect unauthorised access to their account.

Subject to applicable law and any overriding legal obligations on the part of RRToto (such as AML record-keeping requirements), you have the following rights in respect of your Personal Data:

To exercise any of the above rights, please contact the RRToto support team at [email protected]. We will respond to all verifiable requests within a reasonable timeframe not exceeding 30 days from receipt of the request. We may require proof of identity before processing a rights request to protect against unauthorised access to your data.

The RRToto Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain Personal Data relating to persons under the age of 21. Any registration or account access by a person under 21 constitutes a breach of our Terms & Conditions and will result in immediate account termination.

If RRToto becomes aware that Personal Data has been collected from a person under the minimum age, that data will be promptly deleted from our systems and the associated account will be permanently closed. Any deposits associated with such an account will be handled in accordance with our compliance procedures.

The RRToto Platform may, from time to time, reference or integrate with third-party services, including payment gateways (such as Touch 'n Go eWallet, DuitNow, and FPX infrastructure), game content providers, and identity verification services. While we exercise care in selecting compliant partners, we are not responsible for the privacy practices of third-party services or platforms.

Each third-party service provider operates under its own privacy policy, which governs their independent collection and processing of data when you interact directly with their systems. We recommend that you review the privacy policies of any third-party service you use in connection with your RRToto account.

RRToto does not embed third-party advertising technologies, social media trackers, or cross-site behavioural advertising cookies into the Platform. Our analytics tools are configured to collect data in an aggregated, privacy-respecting manner and are not used to build commercial advertising profiles of individual players.

RRToto reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or business operations. The "Last Updated" date displayed at the top of this page indicates when the most recent revision was made.

Where amendments are material — meaning they significantly affect your rights or our obligations — we will notify registered players via email to the address on file, via an in-platform notification, or via a prominent notice on the Platform homepage. We recommend that you review this Privacy Policy periodically to stay informed of how your data is handled.

Your continued use of the Platform following the effective date of a revised Privacy Policy constitutes your acknowledgement of, and agreement to be bound by, the updated terms.

For all queries, requests, or concerns relating to this Privacy Policy, the processing of your Personal Data, or the exercise of your data subject rights, please contact the RRToto Data Protection team using the details below. Our support team is available 24 hours a day, 7 days a week.

This Privacy Policy was last reviewed and updated on 1 January 2026. Thank you for taking the time to understand how RRToto manages and protects your personal information.