toto68 Privacy Policy — How We Protect Your Personal Data

toto68 ("we", "us", "our") is an internationally licensed online casino and sports betting operator, serving players across Pakistan including Karachi, Lahore, Islamabad, Faisalabad, Multan, and Peshawar, through the platform accessible at toto68.one.

toto68 is the Data Controller in respect of all personal data collected through the toto68 platform. As Data Controller, we determine the purposes and means by which your personal data is processed and are responsible for ensuring that such processing is lawful, fair, and transparent.

toto68 collects personal data through the following channels: directly from you when you register, complete KYC verification, make deposits or withdrawals, contact customer support, or interact with promotional offers; automatically through your use of the platform, including technical and usage data described above; and from third-party sources, including licensed game providers and fraud prevention services where permitted by applicable law.

The specific categories of personal data we collect, and the purposes and legal bases for each, are summarised in the data category table on this page. toto68 does not collect or process special category data (such as data concerning racial origin, political opinions, religious beliefs, or health status) unless strictly required by applicable regulatory obligations and only with appropriate safeguards in place.

toto68 uses the personal data it collects for the following purposes:

• Account Operation: To create, maintain, and administer your toto68 player account, verify your identity, process login authentication, and provide access to the platform's game library, sportsbook, and wallet services.
• Transaction Processing: To process deposits from and withdrawals to your verified Pakistani payment methods (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, USDT TRC20), maintain accurate transaction records, and handle any associated disputes.
• KYC and Regulatory Compliance: To verify your age (21+ requirement), identity, and the legitimacy of your funding sources in compliance with anti-money laundering (AML) and know-your-customer (KYC) obligations imposed by our licensing authority.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, account takeover attempts, money laundering, and any other unlawful use of the toto68 platform.
• Responsible Gaming: To monitor gameplay patterns for indicators of problem gambling behaviour, to enforce deposit limits and self-exclusion instructions applied by Players, and to fulfil our obligations under the responsible gaming provisions of our gaming licence.
• Customer Support: To respond to enquiries, process complaints, and maintain support correspondence records for quality assurance and dispute resolution purposes.
• Platform Improvement: To analyse usage patterns, identify technical issues, and improve the overall performance, security, and user experience of the toto68 platform for Pakistani players.
• Marketing Communications: To send promotional offers, bonus notifications, VIP programme updates, and PSL season promotions to Players who have provided their consent to receive such communications. Players who have not provided consent will not receive marketing emails.

toto68 processes your personal data only where a recognised legal basis applies. The legal bases we rely upon are as follows:

• Contractual Necessity: Processing is necessary to perform our contract with you — i.e., to operate your toto68 account, process your transactions, provide access to games and betting markets, and fulfil the obligations set out in our Terms & Conditions. Without this processing, toto68 cannot provide its services to you.
• Legal Obligation: Processing is required to comply with applicable legal obligations, including AML/KYC regulatory requirements imposed by our gaming licence, age verification mandates, and any obligations arising from cooperation with law enforcement or regulatory authorities.
• Legitimate Interests: Processing is necessary for the legitimate interests of toto68, including fraud detection, platform security, responsible gaming monitoring, and improving the quality of our services, provided such interests are not overridden by your own interests or fundamental rights.
• Consent: Where you have provided explicit consent — for example, by opting into marketing communications — toto68 will process your data for that specific purpose. You may withdraw your consent at any time by contacting [email protected] or by using the opt-out mechanism in any marketing communication. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

toto68 may share your personal data with the following categories of third parties in the following circumstances:

• Payment Processing Partners: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, SadaPay, and USDT TRC20 processors — for the sole purpose of facilitating your deposit and withdrawal transactions. These providers are bound by their own data protection obligations and are not permitted to use your data for any other purpose.
• Licensed Game Providers: Pragmatic Play, PG Soft, Jili, Habanero, Spadegaming, and other licensed studios whose games are accessible through the toto68 platform — to the extent necessary to operate your game sessions, record outcomes, and resolve any game-related disputes.
• Identity Verification Services: Third-party KYC and AML verification providers engaged by toto68 to fulfil its regulatory obligations. These providers process your identity documents and financial data strictly for verification purposes.
• Fraud Prevention Services: Specialist fraud detection and risk management providers who assist toto68 in identifying and preventing fraudulent account activity. Shared data is used only for fraud assessment.
• Regulatory Authorities and Law Enforcement: toto68 may disclose your personal data to its licensing authority, relevant regulatory bodies, or law enforcement agencies where required to do so by applicable law, court order, or regulatory directive.
• Professional Advisers: Legal, audit, and compliance advisers engaged by toto68, subject to professional confidentiality obligations, where access to your data is necessary for their advisory function.

Where toto68 shares your personal data with third-party processors, we do so under written data processing agreements that require those processors to maintain appropriate security standards and to process your data only for the purposes specified by toto68.

toto68 retains your personal data for no longer than is necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The following retention periods apply as a general guide:

• Account Data and Transaction Records: Retained for a minimum of five (5) years following account closure or the date of the last transaction, in accordance with AML regulatory record-keeping requirements applicable to licensed gaming operators.
• KYC Documents: Retained for a minimum of five (5) years following the completion of the KYC process or account closure, whichever is later.
• Customer Support Correspondence: Retained for three (3) years from the date of the most recent communication in a support thread, for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Retained for three (3) years from the date of consent withdrawal or account closure, to demonstrate compliance with consent obligations.
• Technical and Usage Data: Retained for thirteen (13) months from the date of collection for analytical and security purposes.

Upon expiry of the applicable retention period, toto68 will securely delete or irreversibly anonymise your personal data. Where data is anonymised, the anonymised data may be retained for statistical or analytical purposes without limitation.

toto68 uses cookies and similar technologies — including session identifiers, local storage objects, and pixel tags — to operate and improve the platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the operation of the toto68 platform. These include session cookies that maintain your logged-in state, security cookies that prevent cross-site request forgery, and preference cookies that remember your language and display settings. These cookies cannot be disabled.
• Functional Cookies: Used to provide enhanced functionality, including remembering your game preferences, last-played titles, and bonus notification dismissal status. Disabling these cookies may reduce the quality of your toto68 experience.
• Analytics Cookies: Used to collect aggregated, anonymised data about how players navigate and use the toto68 platform, enabling us to identify and resolve technical issues and optimise platform performance. Analytics data is not linked to identifiable individual profiles.
• Security and Fraud Prevention Cookies: Used to detect and prevent fraudulent activity, including account takeover attempts, and to enforce geographic access controls.

toto68 does not deploy advertising or behavioural tracking cookies that build profiles for sale to third-party advertisers. You may manage cookie preferences through your browser settings. Note that disabling all cookies will impair your ability to use the toto68 platform.

toto68 implements a layered security architecture to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Our security measures include:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the toto68 platform — including login credentials, payment information, and personal details — is protected by 256-bit SSL encryption. This is the same standard used by international banking institutions.
• Encryption at Rest: Sensitive data fields stored in toto68 databases, including identity documents and financial reference data, are encrypted at rest using industry-standard encryption protocols.
• Access Controls: Access to systems containing your personal data is restricted to authorised toto68 personnel who require such access to perform their job functions. All access is logged and subject to periodic review.
• Two-Factor Authentication: toto68 supports and encourages the use of two-factor authentication (SMS OTP to your registered Pakistani mobile number) on all player accounts to prevent unauthorised account access.
• Regular Security Audits: toto68 systems undergo regular internal and third-party security assessments to identify and remediate vulnerabilities. Our licensing authority may also conduct or require independent security audits as a condition of our licence.
• Data Breach Response: In the event of a personal data breach that poses a risk to your rights and freedoms, toto68 will notify the relevant regulatory authority within 72 hours of becoming aware of the breach and will inform affected Players without undue delay where required by applicable law.

Depending on the jurisdiction applicable to you and the legal basis under which your data is processed, you may have the following rights in respect of your personal data held by toto68. To exercise any of these rights, contact us at [email protected]:

• Right of Access: You have the right to request confirmation of whether toto68 holds personal data about you, and to obtain a copy of that data along with information about how it is used.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data toto68 holds about you. toto68 will action verified rectification requests within 14 days.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. Note that toto68 may be required to retain certain data for regulatory compliance purposes even where an erasure request is made.
• Right to Restriction of Processing: You have the right to request that toto68 restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data or object to its processing.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: Where processing is based on legitimate interests, you have the right to object to such processing. toto68 will cease processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

toto68 will respond to all data subject rights requests within 14 calendar days of receipt. Where a request is complex or numerous, this period may be extended by a further 30 days, in which case toto68 will notify you of the extension and the reasons for it within the initial 14-day period.

If toto68 becomes aware that it has inadvertently collected personal data from an individual who is under the age of 21, we will take prompt steps to delete that data from our systems. If you believe that a minor may have registered a toto68 account, please contact us immediately at [email protected] so that the account can be investigated and closed.

toto68 may send promotional communications — including welcome bonus offers, reload bonuses, PSL season promotions, VIP programme updates, and responsible gaming reminders — to Players who have provided their explicit consent to receive such communications at the point of account registration or subsequently via account settings.

• toto68 will not send unsolicited marketing communications to any Player who has not provided consent, or who has previously opted out of marketing communications.
• You may withdraw your marketing consent and unsubscribe from promotional emails at any time by following the unsubscribe link in any marketing email or by sending a withdrawal request to [email protected].
• Withdrawal of marketing consent does not affect the delivery of transactional communications — including deposit confirmations, withdrawal notifications, KYC request notices, and account security alerts — which toto68 will continue to send as these are necessary for the operation of your account.
• toto68 does not share your contact details with third-party marketers for the purpose of sending you promotional communications from those third parties.

toto68 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, applicable law, or regulatory requirements. The effective date at the top of this Policy will be updated each time a material change is made.

Where amendments are material — meaning they significantly change how your personal data is collected, used, or shared — toto68 will provide advance notice of the changes by publishing the updated Policy on the toto68 platform and, where practicable, by notifying you via your registered email address or through a notification on the platform upon your next login.

Your continued use of the toto68 platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the updated Policy. If you do not accept any revised Policy, you should cease using the platform and contact [email protected] to request account closure.