Privacy Policy

dbltoto ("we", "us", "our", "the Company") is committed to protecting and respecting the privacy of all individuals who interact with our online casino and sports betting platform accessible at https://dbltoto.cam (the "Platform"). This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by dbltoto.

This Policy applies to all players, registered account holders, and visitors to the Platform, including individuals accessing the Platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and elsewhere in Malaysia or other permitted jurisdictions.

Please read this Privacy Policy carefully before registering an account or using the Platform. By accessing the Platform or creating an account, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. This Privacy Policy should be read alongside our Terms & Conditions.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

dbltoto collects personal data through several channels: directly from you when you register, make deposits or withdrawals, contact support, or use Platform features; automatically through your interaction with the Platform; and from third-party verification providers where necessary for compliance purposes.

• Identity Data: Full legal name, date of birth, gender, nationality, and copies of government-issued identification (e.g., Malaysian MyKad / NRIC, passport).
• Contact Data: Email address, mobile phone number, and residential address including postcode and city (e.g., Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru).
• Account Data: Username, password (stored in hashed form), security questions, and account preferences.
• Financial Data: Bank account details, payment method information (FPX bank, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong), transaction history, deposit and withdrawal records, and cryptocurrency wallet addresses where applicable.
• Responsible Gambling Data: Self-declared deposit limits, loss limits, session restrictions, and self-exclusion status where voluntarily set by you.
• Communications Data: Content of messages sent to our support team, including live chat transcripts and email correspondence.

• Technical Data: IP address, browser type and version, operating system, device type and identifiers, screen resolution, and time zone.
• Usage Data: Pages viewed, game titles accessed, betting history, session duration, click paths, and search queries within the Platform.
• Cookie Data: Session tokens, preference cookies, analytics identifiers, and performance tracking data. See Section 7 for full cookie details.

• KYC Verification Providers: Identity verification and fraud scoring data returned by our third-party KYC and Anti-Money Laundering (AML) screening partners during account verification.
• Payment Processors: Transaction confirmation references and payment status updates from DuitNow, FPX, and e-wallet providers.
• Fraud Prevention Services: Device fingerprint risk scores and IP reputation data used to detect and prevent fraudulent account activity.

dbltoto processes personal data only where a valid legal basis exists. The applicable legal bases for our processing activities are as follows:

dbltoto uses the personal data we collect for the following specific purposes. Where we rely on legitimate interests as the legal basis, we have assessed that our interests are not overridden by your rights and freedoms.

• Account Management: Creating and maintaining your account, authenticating your identity on login, processing account settings changes, and managing account closures or suspensions.
• Payment Processing: Processing deposits and withdrawals via your chosen payment method (DuitNow, FPX, Touch 'n Go eWallet, Maybank, CIMB, Public Bank, GrabPay, Boost, Hong Leong, or cryptocurrency), and reconciling transaction records.
• Identity & Age Verification: Fulfilling our legal obligation to verify that all players are aged 21 years or above, and confirming that players are who they claim to be before processing withdrawals.
• Fraud & Security: Detecting and preventing fraudulent account activity, unauthorised access, money laundering, and multi-accounting through automated monitoring and manual review processes.
• Responsible Gambling Compliance: Monitoring betting patterns for indicators of problem gambling behaviour, enforcing player-set deposit and loss limits, administering self-exclusion restrictions, and conducting outreach where required by our responsible gambling framework.
• Customer Support: Responding to your queries, complaints, and disputes submitted through live chat, email, or other support channels.
• Platform Improvement: Analysing usage patterns, game performance data, and support interactions to improve the Platform's functionality, user experience, and game selection.
• Legal Compliance: Maintaining records required by applicable law, responding to regulatory requests, and cooperating with law enforcement authorities where legally required.
• Marketing Communications: Sending promotional offers, bonus notifications, and Platform updates via email or push notification — only where you have given explicit consent. You may withdraw consent at any time via your Account settings.

dbltoto may share your personal data with the following categories of third parties, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Service Providers: Financial institutions and e-wallet operators (including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong) to facilitate the processing of deposits and withdrawals. These parties receive only the transaction data necessary to complete the relevant payment.
• KYC & AML Verification Partners: Third-party identity verification and anti-money laundering screening services that process your identity documents and return a verification outcome to dbltoto. These partners are prohibited from using your data for any purpose other than the verification service.
• Fraud Prevention Services: Automated risk assessment and device fingerprinting services that assist in detecting fraudulent or suspicious account activity. Data shared is limited to technical identifiers and behavioural signals.
• Game Studio Technology Providers: The third-party game studios and platform providers whose gaming content is served through the dbltoto Platform. These providers may receive aggregated session data necessary for game functionality and RNG certification, but do not receive personally identifiable information beyond what is operationally required.
• Regulatory & Law Enforcement Authorities: Where required by applicable law, court order, or regulatory mandate, dbltoto may be required to disclose personal data to relevant authorities. We will notify you of such disclosures where legally permitted to do so.
• Corporate Transactions: In the event of a merger, acquisition, reorganisation, or sale of business assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and given the opportunity to exercise your data rights.

The dbltoto Platform uses cookies and similar tracking technologies to enhance your experience, maintain session continuity, and gather analytical data to improve our services. Cookies are small text files placed on your device when you access the Platform.

You may manage non-essential cookie preferences through your browser settings or via the cookie consent panel presented upon your first visit to the Platform. Disabling functional or analytics cookies may affect certain Platform features. Strictly necessary cookies cannot be disabled as they are essential for core Platform operations.

dbltoto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal and regulatory obligations. The following retention periods apply:

• Active Account Data: Retained for the duration of the active account relationship and for a period of 5 years following account closure, in compliance with AML and financial record-keeping requirements.
• Transaction Records: Deposit and withdrawal records, including associated financial data, are retained for a minimum of 6 years from the date of the transaction for tax and regulatory compliance purposes.
• KYC Documents: Identity verification documents are retained for 5 years following account closure or the completion of the transaction for which verification was required, whichever is later.
• Support Communications: Live chat transcripts and email correspondence are retained for up to 3 years for quality assurance and dispute resolution purposes.
• Marketing Consent Records: Records of marketing consent and any subsequent withdrawals of consent are retained for the duration of the account and for 2 years following account closure.
• Technical & Log Data: Server logs and IP address records are retained for up to 12 months for security and fraud prevention purposes, after which they are anonymised or deleted.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

dbltoto implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes, but is not limited to:

• SSL/TLS Encryption: All data transmitted between your device and the dbltoto Platform is encrypted using industry-standard Transport Layer Security (TLS) protocols.
• Password Hashing: Account passwords are stored using one-way cryptographic hashing algorithms and are never stored in plaintext. dbltoto staff cannot access your password in readable form.
• Access Controls: Access to personal data within our systems is restricted to authorised personnel on a strict need-to-know basis, with role-based access controls and multi-factor authentication required for administrative systems.
• Secure Payment Processing: All payment transactions are processed through encrypted and certified payment gateways. dbltoto does not store full bank account numbers or card numbers on its servers.
• Regular Security Audits: Our Platform undergoes periodic internal and third-party security assessments to identify and remediate vulnerabilities.
• Incident Response: dbltoto maintains a data breach response procedure. In the event of a security incident affecting your personal data, we will notify affected parties in accordance with applicable regulatory requirements.

The operation of the dbltoto Platform may involve the transfer of your personal data to servers or service providers located outside of Malaysia. This may include KYC verification partners, fraud prevention services, and game technology infrastructure providers operating internationally.

Where personal data is transferred outside Malaysia, dbltoto ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable data protection frameworks. Such safeguards may include standard contractual clauses, data processing agreements, or transfers to jurisdictions recognised as providing an adequate level of data protection.

By using the Platform, you acknowledge and consent to such international transfers where necessary for the provision of services under our Terms & Conditions.

Subject to applicable law and certain exemptions, you have the following rights in relation to the personal data that dbltoto holds about you. These rights may be exercised by contacting our support team via the channels listed in Section 14.

To exercise any of the above rights, please contact our support team via live chat or by email at the address provided in Section 14. We may require you to verify your identity before processing a data rights request. We aim to respond to all verified requests within 30 calendar days.

The dbltoto Platform is strictly intended for adults aged 21 years and above. We do not knowingly collect personal data from individuals under the age of 21. If you are under the age of 21, you must not use or attempt to access the Platform under any circumstances.

If dbltoto becomes aware that personal data has been collected from an individual under the age of 21, we will take immediate steps to delete the relevant data and close the associated account. Any deposits made by individuals who are subsequently found to be under the minimum age requirement will be refunded to the originating payment method following closure of the account.

dbltoto reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or our data processing practices. When material changes are made, we will provide advance notice by posting an updated version of this Policy on the Platform and, where appropriate, by notifying you via your registered email address.

The updated Policy will display the revised effective date at the top of the document. Your continued use of the Platform after the effective date of any amended Policy constitutes your acknowledgement of and agreement to the updated terms. If you do not agree with any material changes, you should cease using the Platform and request account closure before the effective date of the changes.

The current version of this Privacy Policy is always available at https://dbltoto.cam/privacy-policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or to the personal data dbltoto holds about you, please contact our Data Protection team through the following channels:

• Live Chat: Available 24 hours a day, 7 days a week, directly within the Platform. This is the recommended channel for urgent privacy queries or data rights requests that require immediate attention.
• Email: [email protected] — please use the subject line "Privacy Request" for data rights enquiries, or "Privacy Query" for general privacy questions.
• Response Time: We aim to acknowledge all privacy-related communications within 24 hours and to provide a substantive response to verified data rights requests within 30 calendar days.

For responsible gambling-related concerns, including requests to activate self-exclusion or adjust deposit limits, please also see our Responsible Gambling page for further information and immediate self-help tools available within your Account dashboard.