toto21 Privacy Policy —
How We Handle Your Personal Data

1. Introduction

toto21 takes the privacy and security of your personal information seriously. As a PAGCOR-licensed online gaming platform serving Filipino players across Luzon, Visayas, and Mindanao, toto21 is both legally obligated and genuinely committed to responsible data stewardship.

This Policy is designed to be transparent. It explains, in plain English, exactly what data toto21 holds about you, why we hold it, who may see it, how long we keep it, and what you can do to exercise your privacy rights. We have aimed to avoid overly technical legal language wherever possible, without sacrificing the accuracy and completeness that a document of this kind requires.

This Policy should be read alongside the toto21 Terms & Conditions (available at toto21.co/terms-conditions), which together form the full agreement governing your relationship with toto21.

2. Data Controller Identity

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), the data controller responsible for your personal information is:

If you have any questions about how toto21 processes your personal data, or if you wish to exercise any of your rights under Philippine law, please contact our data protection team at [email protected].

3. Personal Data We Collect

toto21 collects the following categories of personal information:

3.1 Identity & Registration Data

• Full legal name as it appears on a Philippine government-issued identification document;
• Date of birth (required for 21+ age verification under PAGCOR regulations);
• Gender (optional, where provided voluntarily);
• Nationality and country of residence.

3.2 Contact Data

• Philippine mobile number (primary account identifier and OTP delivery channel);
• Email address;
• Residential address (required for KYC verification).

3.3 Identity Verification (KYC) Data

• Copies of government-issued identification documents (e.g., Philippine passport, driver's license, SSS ID, UMID, PhilSys national ID);
• Selfie or liveness check image (where required for enhanced KYC);
• Proof of address documentation (e.g., utility bill, bank statement).

3.4 Financial & Transaction Data

• GCash account number or Maya account identifier (masked);
• Bank account details where bank transfer is used (masked);
• Deposit and withdrawal transaction history, including amounts, timestamps, and payment methods;
• Account balance history.

3.5 Gaming Activity Data

• Game play history including games played, wagers placed, outcomes, and timestamps;
• Bonus claim and wagering progress records;
• Session duration and frequency data;
• Responsible gaming tool settings (deposit limits, session reminders, self-exclusion status).

3.6 Technical & Device Data

• IP address and approximate geolocation derived therefrom;
• Device type, operating system, and browser type;
• Session logs, login timestamps, and authentication records;
• Cookie identifiers and similar tracking technology data (see Section 6).

3.7 Communications Data

• Records of communications between you and toto21 customer support (live chat transcripts, email correspondence);
• Survey responses and feedback provided voluntarily.

4. How We Collect Your Data

toto21 collects personal data through the following means:

• Directly from you — during account registration, KYC submission, deposit or withdrawal requests, support interactions, and any voluntary communications you initiate with toto21;
• Automatically — through the use of cookies, web server logs, and similar technologies as you browse and use the toto21 Platform (see Section 6);
• From payment processors — transaction confirmation and status data from GCash, Maya, and other integrated Philippine payment providers;
• From identity verification providers — where toto21 uses a third-party KYC service, that provider may supply the results of document authenticity checks;
• From regulatory and law enforcement bodies — in limited circumstances where toto21 is legally required to obtain or verify information about a player to comply with Philippine law.

5. Purpose & Legal Basis for Processing

toto21 processes your personal data for the following purposes, each grounded in a lawful basis under the Philippine Data Privacy Act:

5.1 Contract Performance

Processing necessary to provide toto21's gaming services, manage your Account, process deposits and withdrawals, and fulfill our contractual obligations to you as a registered Player.

5.2 Legal and Regulatory Compliance

Processing required to comply with Philippine law, including the Anti-Money Laundering Act, PAGCOR licensing conditions, Bangko Sentral ng Pilipinas payment regulations, and any lawful requests from Philippine government agencies.

5.3 Legitimate Interests

Processing necessary for toto21's legitimate interests, which include fraud detection and prevention, platform security, responsible gaming monitoring, internal analytics to improve platform quality, and the investigation of complaints or disputes.

5.4 Consent

Where toto21 relies on your consent to process data — particularly for optional marketing communications — you have the right to withdraw that consent at any time (see Section 13). Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

6. Cookies & Tracking Technologies

toto21 uses cookies and similar technologies (such as local storage and session identifiers) to operate the Platform effectively. These technologies serve the following functions:

• Strictly Necessary Cookies: Essential for Platform operation — session management, authentication, account security, and fraud prevention. These cannot be disabled without impairing Platform functionality;
• Functional Cookies: Remember your preferences (such as language settings and responsible gaming tool configurations) to provide a personalized experience;
• Analytics Cookies: Collect aggregated, anonymized data about how Players use the Platform to help toto21 improve performance, identify errors, and optimize the user experience;
• Marketing Cookies: Used — only with your consent — to deliver toto21 promotional content relevant to your gaming interests. You may withdraw consent for marketing cookies at any time via your browser settings.

toto21 does not use third-party advertising network cookies that would allow external advertisers to track your activity across other websites. Our cookie use is limited to internal platform operation and first-party analytics.

You may manage your cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in to and use the toto21 Platform.

7. Disclosure of Your Data to Third Parties

toto21 does not sell your personal information. We share your data with third parties only in the following circumstances:

7.1 Regulated Disclosures

toto21 is legally required to share certain player information with:

• PAGCOR — as required by toto21's gaming license, including player registration data, transaction records, and responsible gaming reports;
• Anti-Money Laundering Council (AMLC) — where transactions meet reporting thresholds under the Anti-Money Laundering Act (Republic Act No. 9160, as amended);
• Philippine law enforcement authorities — in response to lawful warrants, court orders, or legal process;
• National Privacy Commission (NPC) — in the event of a personal data breach notification as required by law.

7.2 Service Providers

toto21 shares limited personal data with trusted service providers who act as data processors under binding agreements that prohibit them from using your data for any purpose other than providing services to toto21. These include:

• KYC and identity verification service providers;
• Payment processing partners (GCash, Maya, BPI, BDO, Metrobank, and other integrated PH payment providers);
• Fraud detection and anti-money laundering screening services;
• Cloud infrastructure and hosting providers;
• Customer support platform providers (for live chat and ticketing systems).

7.3 Game Providers

Live casino, slot, and other game software is provided by third-party game studios. toto21 shares only a pseudonymized Player identifier (not your full name or contact details) with game providers for the purpose of game session authentication and results integrity.

8. International Data Transfers

toto21's primary data processing operations are conducted within the Republic of the Philippines. However, some service providers — particularly cloud infrastructure and certain game software providers — may operate servers outside of the Philippines.

Where personal data is transferred to countries that may not provide the same level of data protection as Philippine law, toto21 ensures that such transfers are protected by appropriate safeguards, including:

• Standard contractual clauses that require overseas recipients to implement data protection standards equivalent to those required under Philippine law;
• Adequacy assessments where required by the National Privacy Commission's guidelines on cross-border data transfers.

If you wish to obtain more information about the specific safeguards applied to international data transfers involving your personal information, please contact toto21 at [email protected].

9. Data Retention

toto21 retains your personal data only for as long as necessary for the purposes described in this Policy, subject to the following minimum retention requirements:

• Account and identity data: Retained for a minimum of five (5) years following Account closure, as required by PAGCOR licensing conditions and anti-money laundering regulations;
• Financial and transaction records: Retained for a minimum of five (5) years from the date of each transaction, as required by the Anti-Money Laundering Act;
• KYC documentation: Retained for the duration of the Account plus five (5) years following closure;
• Gaming activity records: Retained for five (5) years following Account closure for regulatory compliance purposes;
• Customer support communications: Retained for three (3) years from the date of the last communication;
• Marketing consent records: Retained for the duration of the consent and for three (3) years following withdrawal of consent, to demonstrate compliance.

Following the expiry of applicable retention periods, toto21 will securely delete or irreversibly anonymize your personal data. Where data cannot be deleted due to technical constraints (for example, encrypted backup archives), it will be isolated from active processing systems until it can be securely deleted.

10. Security Measures

toto21 implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction:

• Encryption: All data in transit is protected by 256-bit SSL/TLS encryption. Sensitive data at rest (including KYC documents and payment details) is encrypted using industry-standard algorithms;
• Access controls: Access to personal data is restricted on a strict need-to-know basis. Staff with access to player personal information are subject to background checks, confidentiality obligations, and regular security training;
• Two-factor authentication: Available for player accounts and mandatory for staff access to systems containing personal data;
• Intrusion detection: Network activity is monitored by automated intrusion detection systems. Anomalous activity triggers immediate investigation;
• Vulnerability management: Regular penetration testing and security audits are conducted by qualified independent security professionals;
• Incident response: toto21 maintains a documented data breach response procedure. In the event of a breach affecting your personal data, toto21 will notify the National Privacy Commission within seventy-two (72) hours and affected players without undue delay, as required by Philippine law.

11. Your Data Subject Rights

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations, you have the following rights with respect to your personal data held by toto21:

toto21 will verify your identity before processing any data subject rights request to protect against unauthorized access to your personal information. We will respond to valid requests within fifteen (15) business days. In complex cases, we may extend this period by an additional fifteen (15) business days, in which case we will notify you of the extension.

12. Children, Minors & Age Verification

The toto21 Platform is strictly available to individuals aged twenty-one (21) years or older, as mandated by PAGCOR. toto21 does not knowingly collect personal information from individuals below the age of 21.

Age verification is conducted during the registration process and is confirmed through KYC documentation prior to the processing of any withdrawal. Where toto21 becomes aware that personal data has been collected from an individual below the minimum age, toto21 will:

• Immediately suspend the associated Account;
• Delete the personal data collected, to the extent permitted by applicable regulatory retention obligations;
• Return any deposited funds to the originating payment method;
• Report the incident to PAGCOR as required by its responsible gaming framework.

If you are a parent or guardian and believe a minor has registered an account on toto21 using false age information, please contact toto21 immediately at [email protected] with the relevant details so that we can investigate and act accordingly.

13. Marketing Communications

With your consent, toto21 may send you promotional communications about new games, bonuses, platform features, and special offers relevant to your interests as a toto21 player. Marketing communications may be sent via email and/or SMS to your registered contact details.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "Unsubscribe" link in any toto21 marketing email;
• Replying STOP to any toto21 promotional SMS;
• Updating your communication preferences in your toto21 Account settings;
• Contacting [email protected] with a request to opt out of all marketing.

Please allow up to five (5) business days for your opt-out preference to take effect across all channels. After opting out, you will continue to receive transactional communications (such as deposit confirmations, withdrawal updates, and security alerts), which are necessary for the operation of your Account and cannot be opted out of while your Account remains active.

14. Updates to This Privacy Policy

toto21 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, Philippine legal requirements, PAGCOR regulatory guidance, or operational needs. Material changes to this Policy will be communicated to registered Players via email and/or a prominent notice on the toto21 Platform at least seven (7) days before the changes take effect.

The effective date at the top of this Policy indicates the date of the most recent revision. toto21 encourages you to review this Policy periodically. Your continued use of the toto21 Platform after the effective date of any update constitutes your acceptance of the revised Policy.

Previous versions of this Privacy Policy are available upon request by contacting [email protected].

15. Contact & Privacy Complaints

For any questions, concerns, or requests relating to this Privacy Policy or toto21's data processing practices, please contact our data protection team:

If your concern is not resolved to your satisfaction through toto21's internal process, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines, the competent data protection supervisory authority in the Republic of the Philippines.

This Privacy Policy was last reviewed and updated on January 1, 2026. toto21 is committed to maintaining the highest standards of data privacy and security for every Filipino player on the Platform.