Introduction
This Privacy Policy ("Policy") is issued by Totomaniac ("we", "us", "our", "the Platform") and governs the collection, use, storage, disclosure, and protection of personal data submitted by or collected from users ("you", "Member", "Player") in connection with your use of the Totomaniac website at https://totomaniac.cam and all associated services.
Totomaniac is committed to handling your personal data responsibly and in accordance with applicable international data protection principles and online gaming regulations. We recognise that the privacy of our members — whether you are accessing the platform from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, or anywhere else in Malaysia — is fundamental to the trust you place in us.
By registering an account or continuing to use the Totomaniac platform, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy. This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy.
Definitions
For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:
| Term | Meaning |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person, including name, identification number, contact details, financial data, and online identifiers. |
| Data Controller | Totomaniac, as the entity that determines the purposes and means of processing personal data collected through the platform. |
| Data Processor | Any third-party entity that processes personal data on behalf of Totomaniac, including payment processors, KYC service providers, and hosting infrastructure providers. |
| Processing | Any operation performed on personal data, including collection, storage, retrieval, use, disclosure, erasure, or destruction — whether by automated or manual means. |
| Consent | A freely given, specific, informed, and unambiguous indication of agreement by the data subject to the processing of their personal data for a stated purpose. |
| KYC Data | Identity and verification documents submitted by a Member during the Know Your Customer process, including government-issued identification and proof of address. |
| Cookie | A small text file stored on a user's device by a web browser at the instruction of the platform, used to retain session state, preferences, and analytical information. |
| Member / Player | Any natural person who has completed the Totomaniac account registration process and uses the platform's services. |
Personal Data We Collect
Totomaniac collects personal data that is necessary to provide our services, verify member identities, process financial transactions, and comply with applicable regulatory obligations. The categories of personal data we collect include the following:
3.1 Registration Data. When you create an account on Totomaniac, we collect your chosen username, email address, date of birth, and the password you set (stored in encrypted form). This information is required to establish and maintain your account.
3.2 Identity Verification (KYC) Data. As part of our Know Your Customer and Anti-Money Laundering obligations, we may request and retain copies of government-issued photo identification (such as a Malaysian MyKad, Passport, or Driver's License), proof of residential address (such as a utility bill or bank statement dated within three months), and where applicable, source of funds documentation.
3.3 Financial Transaction Data. We retain records of all deposits, withdrawals, and wagers made through your account. This includes transaction amounts in Malaysian Ringgit (MYR) or cryptocurrency equivalent, timestamps, transaction reference numbers, and the payment method used — which may include Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, or supported cryptocurrency addresses.
3.4 Technical and Device Data. We automatically collect certain technical information when you access the platform, including your IP address, device type and operating system, browser type and version, session duration, pages visited, referring URL, and general geographic location (derived from IP address).
3.5 Communications Data. If you contact our support team via live chat or email, we retain records of those communications, including the content of your messages, timestamps, and any files or documents you submit in connection with a query or complaint.
3.6 Behavioural and Gaming Data. We collect data relating to your activity on the platform, including games played, bet sizes, win/loss records, session frequency, and interaction with promotional materials. This data is used for platform improvement, personalisation, and responsible gambling monitoring purposes.
How We Collect Your Data
Totomaniac collects personal data through the following means:
- Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or participate in a promotion.
- Automatically — through cookies, web beacons, server logs, and similar tracking technologies as you interact with the platform.
- From third parties — including identity verification service providers engaged for KYC purposes, payment processors who confirm transaction status, and fraud prevention agencies.
- From public sources — where necessary for fraud detection, AML compliance, or responsible gambling monitoring, we may cross-reference publicly available information.
All data collection methods employed by Totomaniac are proportionate to the stated purposes and are subject to appropriate technical and organisational safeguards.
Purpose & Legal Basis for Processing
We process your personal data only where we have a lawful basis to do so. The table below sets out the primary purposes for which Totomaniac processes personal data and the corresponding legal basis in each case:
| Purpose of Processing | Legal Basis |
|---|---|
| Account registration and management, including verification of eligibility and age (21+). | Contractual Necessity |
| Processing deposits, withdrawals, and maintaining accurate financial records of all transactions. | Contractual Necessity |
| KYC identity verification and Anti-Money Laundering (AML) compliance checks. | Legal Obligation |
| Detecting and preventing fraud, abuse, collusion, and prohibited conduct on the platform. | Legitimate Interest |
| Responsible gambling monitoring, including flagging unusual account behaviour and enforcing player-set limits. | Legal Obligation / Legitimate Interest |
| Providing customer support and resolving account queries, complaints, and disputes. | Contractual Necessity |
| Sending transactional communications such as withdrawal confirmations and KYC status updates. | Contractual Necessity |
| Sending promotional communications, bonus offers, and marketing materials where you have opted in. | Consent |
| Platform analytics, performance monitoring, and product improvement. | Legitimate Interest |
| Compliance with applicable regulatory requirements, court orders, or lawful government requests. | Legal Obligation |
Where processing is based on your consent, you retain the right to withdraw that consent at any time without affecting the lawfulness of processing conducted prior to withdrawal. To opt out of marketing communications, update your notification preferences in your account settings or contact our support team.
Data Processing Principles
Totomaniac processes all personal data in accordance with the following core principles, which guide our internal data governance framework:
6.1 Lawfulness, Fairness, and Transparency. We process personal data only on lawful grounds as described in Section 5. We do not use your data in ways that are unexpected, opaque, or contrary to the purposes for which it was collected.
6.2 Purpose Limitation. Personal data collected for a specific purpose is not subsequently used for a materially different, incompatible purpose without your knowledge and, where required, your explicit consent.
6.3 Data Minimisation. We collect and retain only the personal data that is necessary and proportionate to the purposes described in this Policy. We do not collect data speculatively or in volumes exceeding operational requirements.
6.4 Accuracy. We take reasonable steps to ensure that personal data held on our systems is accurate and, where necessary, kept up to date. Members are responsible for ensuring that their registered information (particularly email address and date of birth) remains accurate and may update account details via the account dashboard or by contacting support.
6.5 Storage Limitation. Personal data is retained only for as long as is necessary to fulfil the purposes for which it was collected, subject to applicable legal and regulatory minimum retention requirements. See Section 8 for specific retention periods.
6.6 Integrity and Confidentiality. We implement appropriate technical and organisational security measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. See Section 11 for further detail on our security practices.
Data Sharing & Disclosure
Totomaniac does not sell, rent, or trade your personal data to third parties for commercial purposes. We may, however, share your personal data with the following categories of third parties where necessary and in accordance with applicable data protection principles:
7.1 Payment Service Providers. We share financial transaction data with the payment processors required to execute your deposits and withdrawals. This includes e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), banking partners (Maybank, CIMB, Public Bank, Hong Leong Bank), DuitNow and FPX infrastructure providers, and cryptocurrency network processors. These entities are contractually bound to process data only for the purpose of executing the relevant financial transaction.
7.2 KYC and Identity Verification Providers. We engage third-party identity verification service providers to assist with age verification, document authentication, and AML screening. These providers process the personal and documentary data you submit during the KYC process solely for verification purposes.
7.3 Fraud Prevention and Security Services. Where fraud, suspicious activity, or platform abuse is detected or suspected, we may share relevant account and transaction data with fraud prevention agencies, security service providers, or law enforcement authorities.
7.4 Regulatory and Legal Authorities. Totomaniac will disclose personal data to competent regulatory bodies, law enforcement agencies, or judicial authorities where required to do so by law, court order, or regulatory direction. We do not make such disclosures voluntarily and will limit the scope of disclosure to what is strictly required.
7.5 Technology and Hosting Providers. Our platform infrastructure is hosted on third-party cloud and data centre services. These providers may process personal data as part of their service delivery and are subject to contractual data processing agreements that restrict their use of such data.
Data Retention
Totomaniac retains personal data for as long as is necessary to fulfil the purpose for which it was collected, and in compliance with applicable minimum legal retention requirements. The following general retention periods apply:
| Category of Data | Retention Period |
|---|---|
| Account registration data (username, email, date of birth) | Duration of account + 5 years post-closure |
| KYC and identity verification documents | Duration of account + 5 years post-closure (AML requirement) |
| Financial transaction records (deposits, withdrawals, wagers) | Duration of account + 7 years post-closure |
| Customer support communications | 3 years from date of communication |
| Technical / device log data (IP address, session data) | 12 months from collection |
| Marketing consent records | Until consent is withdrawn, plus 2 years |
| Responsible gambling interaction records (limit settings, self-exclusion) | Duration of account + 5 years post-closure |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures. Anonymised or aggregated data that can no longer be linked to any individual may be retained indefinitely for analytical and platform improvement purposes.
Cookies & Tracking Technologies
Totomaniac uses cookies and similar tracking technologies to operate and improve the platform, maintain your session state, analyse usage patterns, and where you have consented, serve personalised content. The following categories of cookies are employed:
9.1 Strictly Necessary Cookies. These cookies are essential for the operation of the platform and cannot be disabled. They are required for functions such as maintaining your logged-in session, processing transactions, and enforcing security controls.
9.2 Analytics & Performance Cookies. These cookies collect aggregated, anonymised data on how members use the platform — which pages are visited most frequently, where users enter and exit the site, and which features are most used. This data helps us improve the platform experience.
9.3 Preference Cookies. These cookies remember your platform settings, such as preferred language, notification preferences, and display configurations, so you do not need to reset them on every visit.
9.4 Marketing Cookies. Where you have provided consent, marketing cookies are used to track engagement with promotional content and tailor bonus communications to your activity profile. You may withdraw consent for marketing cookies at any time.
Most web browsers allow you to manage cookie preferences through their settings. Disabling strictly necessary cookies will impair the functionality of the platform. For all other categories, you may disable cookies without affecting your ability to use core platform features, though some personalisation functions may be reduced.
Your Data Rights
Subject to applicable law and the specific circumstances of your request, you have the following rights in relation to your personal data held by Totomaniac. To exercise any of these rights, contact our support team using the details in Section 15.
We will respond to all verified data rights requests within 30 calendar days of receipt. In complex cases, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reason for it within the initial 30-day period.
Please note that certain rights are subject to limitations — for example, the right to erasure cannot override our obligation to retain financial transaction records for AML compliance purposes. Where a request is declined, we will provide reasons and advise you of any available recourse.
Data Security
Totomaniac employs a multi-layered security framework to protect personal data against unauthorised access, disclosure, alteration, and destruction. Our security measures include:
- Transport Layer Security (TLS/SSL): All data transmitted between your device and the Totomaniac platform is encrypted using 256-bit SSL/TLS encryption. The padlock symbol in your browser address bar confirms that a secure, encrypted connection is active.
- Password Hashing: Member passwords are never stored in plain text. They are hashed using industry-standard one-way cryptographic algorithms, meaning that even internal staff cannot retrieve your password.
- Access Controls: Access to personal data within our systems is restricted on a strict need-to-know basis. Internal staff are granted data access only where required for their specific role and are subject to confidentiality obligations.
- Infrastructure Security: Our platform infrastructure employs firewalls, intrusion detection systems, and regular security audits to identify and address vulnerabilities.
- KYC Document Security: Identity documents submitted during KYC are encrypted at rest and stored in access-controlled environments separate from general platform data.
- Incident Response: In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, Totomaniac will notify affected members and relevant authorities within the timeframes required by applicable regulations.
Third-Party Links & Services
The Totomaniac platform may integrate third-party services as part of its product offering, including game content provided by licensed software suppliers and payment processing interfaces. While Totomaniac selects these third-party partners carefully and requires them to maintain adequate data protection standards, we are not responsible for the privacy practices of those parties in respect of data they independently collect and process.
This Privacy Policy applies solely to personal data collected and processed by Totomaniac in connection with the use of the platform at https://totomaniac.cam. Any data submitted directly to a third-party game provider, payment processor, or other embedded service is subject to that party's own privacy policy.
We encourage members to review the privacy documentation of any third-party service they interact with directly, particularly in the context of payment processing where you may be redirected to an external payment interface (e.g. a banking portal for FPX transactions, or an e-wallet provider's app for Touch 'n Go eWallet or Boost payments).
Children & Minors
The Totomaniac platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data from persons under the age of 21.
Our registration process includes an age verification step requiring disclosure of date of birth. Where a Member is subsequently found to be under the age of 21, their account will be immediately suspended, all pending transactions will be halted, and any deposited funds will be returned to the originating payment method following verification. Personal data collected from underage individuals will be securely deleted, except where retention is required for the purpose of demonstrating regulatory compliance.
Policy Amendments
Totomaniac reserves the right to update or amend this Privacy Policy at any time. Changes may be made in response to regulatory developments, updates to our services, or changes in our data processing practices.
All amendments will be published on this page with a revised "Last Updated" date. Where a change is material — meaning it significantly affects your rights or the way we use your data — we will endeavour to notify registered members via the email address associated with their account prior to the change taking effect.
Your continued use of the Totomaniac platform following the publication of any revised Privacy Policy constitutes your acceptance of those changes. If you do not agree with any amendment, you should cease using the platform and may request account closure by contacting our support team.
Contact Us
If you have any questions about this Privacy Policy, wish to exercise a data right, or wish to submit a privacy-related complaint, please contact the Totomaniac data team using the following details: