toto21 Privacy Policy

Who We Are

toto21 ("we", "us", "our", "the Platform") operates the online casino and sports betting website accessible at https://toto21.today and any associated mobile or digital applications. toto21 is Bangladesh's leading online gaming platform offering cricket betting, live casino tables, slot games, and fishing games with support for local payment methods including bKash, Nagad, and Rocket.

As the operator of this platform, toto21 acts as the data controller in respect of the personal data of all registered players and website visitors. This Privacy Policy applies to all personal data collected by toto21 through your use of the platform, whether you access it via a web browser on a desktop device, a mobile browser, or any dedicated application.

For any privacy-related enquiries, the toto21 Data Contact is reachable at [email protected] with the email subject line "Privacy Enquiry".

Data We Collect

toto21 collects the following categories of personal data from players and website visitors:

We do not collect special category data (such as health data, biometric data, or political opinions) in the ordinary course of operating the platform, except where required by law for identity verification purposes.

How We Collect Your Data

toto21 collects personal data through the following channels:

• Direct interactions: Data you provide when creating your account, completing identity verification (KYC), making a deposit or withdrawal, contacting support, or submitting a complaint.
• Automated technologies: As you navigate the toto21 platform, we automatically collect Technical Data and Usage Data via server logs, cookies, and similar tracking technologies. See Section 7 for full details on cookies.
• Third-party providers: We may receive identity verification data from KYC service providers, fraud-screening data from payment processors, and geolocation data from IP-lookup services. These providers are contractually obligated to handle your data securely and in accordance with their own privacy policies.
• Payment partners: When you deposit or withdraw via bKash, Nagad, Rocket, Upay, or a linked bank account, those payment networks share transaction confirmation data with toto21 to credit or debit your account. We do not receive your full mobile financial service PIN or bank account password.

How We Use Your Data

toto21 uses the personal data we collect for the following purposes:

• Account management: Creating, maintaining, and administering your toto21 player account, including authentication at login and account recovery.
• Identity verification: Verifying that you are who you claim to be, that you meet the minimum age requirement of 18 years, and that you are not a restricted or self-excluded player.
• Payment processing: Processing deposits and withdrawals via bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other supported payment methods. Reconciling transactions and investigating disputed payments.
• Platform operation: Delivering the games, sports betting, promotions, and all other services available on toto21 to you reliably and correctly.
• Bonus and promotion management: Determining your eligibility for welcome bonuses, reload bonuses, free spin offers, and other promotions, and tracking wagering requirement completion.
• Responsible gaming: Monitoring gameplay patterns to identify signs of problem gambling, enforcing deposit limits and self-exclusion requests, and sending responsible gaming reminders where appropriate.
• Security and fraud prevention: Detecting and investigating suspicious account activity, bonus abuse, collusion, money laundering, and other fraudulent or prohibited behaviours.
• Legal and regulatory compliance: Meeting anti-money laundering (AML), Know Your Customer (KYC), and other applicable legal obligations, including cooperating with lawful requests from competent authorities.
• Customer support: Responding to your enquiries, resolving complaints, and maintaining a record of support interactions.
• Marketing communications: Sending you personalised bonus offers, promotional emails, and platform news — but only where you have provided your explicit consent to receive marketing communications and have not subsequently opted out.
• Platform improvement: Analysing aggregated, anonymised usage data to understand player behaviour, improve game selection, optimise the user interface, and develop new features.

Legal Basis for Processing

toto21 processes your personal data on the following legal bases:

• Contract performance: Processing is necessary to perform the contract between you and toto21 — specifically to operate your account, process payments, and deliver the games and services you have registered to use.
• Legal obligation: Processing is required to comply with applicable legal requirements, including KYC/AML obligations, age verification requirements, and responses to lawful requests from regulatory authorities.
• Legitimate interests: Processing is carried out for toto21's legitimate business interests — such as fraud prevention, platform security, responsible gaming monitoring, and platform improvement — provided those interests are not overridden by your fundamental rights and freedoms.
• Consent: Where toto21 relies on your consent as the basis for processing (most notably for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Sharing Your Data

toto21 does not sell, rent, or trade your personal data. We share your personal data only in the following limited circumstances and only with parties who are contractually bound to protect it:

• Payment processors: bKash, Nagad, Rocket, Upay, Dutch-Bangla Bank, and other payment partners receive only the transaction data necessary to process your deposit or withdrawal.
• KYC and identity verification providers: Third-party services that assist toto21 in verifying the identity and age of players. These providers operate under strict data processing agreements and are not permitted to use your data for any purpose other than verification.
• Fraud screening and security services: Providers that help toto21 detect and prevent fraudulent activity, bonus abuse, and money laundering. Data shared is limited to technical and transactional identifiers.
• Game providers: Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, Spribe, Ezugi, and other studios receive anonymised session data to deliver their games correctly. They do not receive your full identity or financial data.
• Regulatory and law enforcement authorities: toto21 will disclose personal data to competent authorities where required to do so by law, court order, or lawful regulatory demand.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of toto21's assets, player data may be transferred to the acquiring entity, subject to the same privacy protections outlined in this policy.

In all cases, toto21 takes reasonable steps to ensure that third-party recipients of personal data maintain adequate security standards and use the data only for the specified purpose.

Cookies & Tracking Technologies

toto21 uses cookies and similar tracking technologies (such as pixel tags and local storage objects) on the platform. Cookies are small text files placed on your device by your browser when you visit the toto21 website. They allow toto21 to recognise your device across sessions and to deliver a consistent, personalised experience.

toto21 uses the following categories of cookies:

• Strictly necessary cookies: Essential for the platform to function. These include session authentication cookies that keep you logged in during your visit. These cannot be disabled without rendering the platform non-functional.
• Performance and analytics cookies: Collect anonymised information about how players use the platform — such as which games are most popular, which pages generate errors, and overall session flow — to help toto21 improve the product.
• Functionality cookies: Remember your preferences such as preferred language, previously selected game categories, and display settings so you do not need to re-enter them on each visit.
• Targeting and marketing cookies: Used only where you have consented to receiving personalised promotional communications. These allow toto21 to tailor bonus offers and promotions to your interests and activity.

You may manage your cookie preferences through your browser settings at any time. Disabling certain categories of cookies may affect the functionality of the toto21 platform. Strictly necessary cookies cannot be disabled while using the platform.

Data Security

toto21 employs a multi-layered security architecture to protect the personal data of all players. Key security measures in place include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and toto21's servers.
• Encrypted password storage using industry-standard hashing algorithms. toto21 staff do not have access to your plaintext password.
• Access controls: Personal data is accessible only to authorised toto21 personnel with a legitimate operational need. Access logs are maintained and reviewed regularly.
• Firewalled, monitored servers: Player data is stored on servers protected by hardware and software firewalls, intrusion detection systems, and 24/7 monitoring.
• Regular security reviews: toto21 conducts periodic security assessments and penetration testing to identify and remediate vulnerabilities proactively.
• Incident response: In the event of a confirmed data breach that poses a risk to your rights and freedoms, toto21 will notify affected players and relevant authorities within the timeframes required by applicable law.

While toto21 takes all reasonable and practicable steps to secure your personal data, no system is completely immune to security risks. You also play a role in keeping your account secure — please use a strong, unique password and never share your login credentials with anyone.

Data Retention

toto21 retains personal data for as long as is necessary to fulfil the purpose for which it was collected and to comply with applicable legal obligations. The following general retention periods apply:

• Active account data: Retained for the full duration of your account's existence on the platform plus a post-closure period as described below.
• Transaction and financial records: Retained for a minimum of five (5) years following the date of the transaction, as required by anti-money laundering regulations.
• KYC identity documents: Retained for a minimum of five (5) years from the date of submission or from the date your account is closed, whichever is later.
• Support communications: Retained for three (3) years from the date of the interaction, to support dispute resolution and quality assurance.
• Marketing preferences and consent records: Retained until you withdraw your consent or for three (3) years from the date of last marketing interaction, whichever occurs first.
• Closed and self-excluded accounts: Account records for self-excluded players are retained for the duration of the self-exclusion period plus five (5) years, to prevent re-registration during the exclusion period and to comply with legal obligations.

After the applicable retention period has elapsed, personal data is securely deleted or irreversibly anonymised so that it can no longer be linked to an individual.

Your Rights Over Your Data

As a toto21 player, you have the following rights in respect of your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request":

• Right of access: You may request a copy of all personal data toto21 holds about you, along with information about how it is processed and on what legal basis.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data held about you. You can update basic account details (such as email address or phone number) directly through your account settings.
• Right to erasure ("right to be forgotten"): You may request that toto21 delete your personal data. This right is subject to limitations — toto21 may need to retain certain data to comply with legal obligations (e.g., AML record-keeping) or to pursue or defend legal claims.
• Right to restriction of processing: You may request that toto21 restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested, or where you have objected to processing based on legitimate interests.
• Right to data portability: Where processing is based on your consent or on contract performance, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to the processing of your personal data where toto21 relies on legitimate interests as the legal basis. You also have an absolute right to object to the use of your data for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

toto21 will respond to all valid data rights requests within 30 days of receipt. Where a request is complex or where a large volume of requests has been received, we may extend this period by a further two months, in which case we will notify you of the extension and the reason for the delay.

Children's Privacy

toto21 is an adult-only platform. We do not knowingly collect, solicit, or process personal data from any individual under the age of 18 years. Access to toto21 by anyone under 18 is strictly prohibited regardless of parental permission.

If toto21 becomes aware that a player under the age of 18 has registered an account or provided personal data, the account will be immediately suspended, any deposits returned where possible, any winnings voided, and all associated personal data deleted as promptly as technically feasible. If you believe that a minor may have created an account on toto21, please notify us immediately at [email protected].

Parents and guardians are encouraged to make use of parental control software to restrict access to online gambling websites. Tools such as GamBlock and similar products can prevent underage individuals from accessing gambling platforms on shared devices.

Third-Party Links

The toto21 platform may contain references to third-party game providers, payment services, and other external services. While toto21 endeavours to link only to reputable and trustworthy services, we have no control over the privacy practices or content of third-party websites and applications.

This Privacy Policy applies solely to data collected by and processed through the toto21 platform at https://toto21.today. If you navigate away from the toto21 website and interact with a third-party service, the privacy policy of that third party will govern how your data is handled. toto21 accepts no responsibility or liability for the privacy practices of third-party services.

Marketing Communications

With your consent, toto21 may send you promotional communications by email or SMS regarding new games, bonus offers, seasonal promotions (such as Eid specials, Pohela Boishakh bonuses, or BPL cricket promotions), and platform news.

You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link included at the bottom of every marketing email sent by toto21.
• Updating your communication preferences in your toto21 account settings.
• Contacting support at [email protected] with the subject line "Unsubscribe".

Please allow up to 5 business days for an opt-out request to take full effect across all communication channels. Opting out of marketing communications will not affect transactional communications relating to your account — such as deposit confirmations, withdrawal notifications, security alerts, or KYC requests — which are sent regardless of marketing preferences as they are necessary for the operation of your account.

Updates to This Privacy Policy

toto21 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When material changes are made, toto21 will:

• Publish the revised Privacy Policy on this page with an updated "Last Updated" date.
• Where the change is significant, notify registered players via email or an in-platform notification before the change takes effect.

Your continued use of toto21 following the publication of a revised Privacy Policy constitutes your acceptance of the updated policy. If you do not agree with the revised policy, you must stop using the platform and may close your account by contacting [email protected].

We encourage you to review this Privacy Policy periodically to stay informed of how toto21 protects and manages your personal data.

Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data by toto21, please reach out to the toto21 support team using the details below:

• Email: [email protected]
• Subject line for data requests: "Privacy Enquiry" or "Data Rights Request"
• Support Hours: 24/7, Bangladesh Standard Time (BST, UTC+6)
• Website: https://toto21.today

For information about responsible gaming tools, deposit limits, and self-exclusion options, please visit the Responsible Gaming page. For answers to common questions about account management, deposits, and withdrawals, visit the FAQ page.