Privacy Policy — How Togelon Handles Your Data

This Privacy Policy ("Policy") is published by Togelon ("we", "us", "our", "the Company"), the operator of the online betting and casino platform accessible attogelon.asia and any associated sub-domains or mobile applications (collectively, the "Platform").

This Policy explains how Togelon collects, uses, discloses, retains, and protects personal data in connection with your use of the Platform. It applies to all registered players, prospective users who browse the Platform, and any other individuals whose personal data Togelon processes in the course of its operations.

By registering for an account, depositing funds, or continuing to use the Platform, you acknowledge that you have read and understood this Policy. This Policy is incorporated by reference into ourTerms and Conditions and should be read in conjunction with that document.

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Processing" means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, storage, adaptation, retrieval, use, disclosure, restriction, or erasure.
• "Controller" means the natural or legal person that determines the purposes and means of the processing of personal data. Togelon is the Data Controller for all personal data processed under this Policy.
• "Processor" means a natural or legal person that processes personal data on behalf of the Controller. This includes third-party service providers engaged by Togelon to deliver specific services.
• "Consent" means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of personal data relating to them.
• "KYC" means Know Your Customer — the mandatory identity and age verification procedures required by our international gaming licence.

Togelon collects personal data through the following means: directly from you during registration and account use; automatically through your interaction with the Platform; and from third-party service providers where required to deliver specific services.

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, genetic data, or health information, except where such data is incidentally disclosed in the context of responsible gambling assessments or support communications. In such cases, the data is processed solely for the purpose for which it was disclosed.

Togelon processes your personal data for the following specific purposes:

• Account management: Creating, operating, and maintaining your player account, including processing login authentication and managing account security.
• KYC and regulatory compliance: Verifying your identity and age (21+ mandatory), complying with anti-money laundering (AML) obligations, and meeting the requirements of our international gaming licence.
• Transaction processing: Processing deposits and withdrawals via Malaysian payment methods including Touch'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, RHB, Hong Leong, and cryptocurrency networks.
• Platform delivery: Providing access to sports betting, live casino games, slots, and all other services on the Platform; personalising your experience; and delivering bonuses and VIP rewards.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity abuse of promotions, unauthorised account access, and other security threats.
• Responsible gambling: Monitoring gambling patterns to identify signs of problem gambling; implementing deposit limits, self-exclusion, and other player protection tools.
• Customer support: Responding to enquiries, complaints, and account issues submitted via live chat or email.
• Marketing communications: Sending you information about promotions, bonuses, and platform updates — where you have opted in to receive such communications. You may opt out at any time.
• Analytics and platform improvement: Analysing aggregate usage data to understand how the Platform is used, identify technical issues, and improve the player experience.
• Legal obligations: Complying with applicable laws, court orders, regulatory requests, or other legally binding obligations.

Togelon processes your personal data on the following legal bases:

• Contractual necessity: Processing required to perform the contract represented by our Terms and Conditions — including account management, transaction processing, and platform delivery.
• Legal obligation: Processing required to comply with applicable laws and our international gaming licence obligations, including KYC, AML checks, and regulatory reporting.
• Legitimate interests: Processing carried out in pursuit of Togelon's legitimate business interests — including fraud prevention, platform security, abuse detection, and aggregate analytics — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing carried out on the basis of your freely given, informed consent — primarily marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Togelon does not sell, rent, or trade your personal data to any third party. We may share your personal data with the following categories of recipients, strictly for the purposes set out in this Policy:

• Payment processors and financial institutions: To facilitate deposits and withdrawals, your financial data may be shared with payment service providers — including Touch 'n Go eWallet, GrabPay, Boost, DuitNow/PayNet, and banking institutions such as Maybank, CIMB, Public Bank, RHB, and Hong Leong — strictly as required to complete your requested transactions.
• KYC and identity verification providers: We use third-party identity verification services to conduct age and identity checks as required by our licensing obligations. These providers process your identity data under strict contractual confidentiality obligations.
• Game software providers: Some data, such as your username and game session identifiers, may be shared with our licensed game content providers to deliver live dealer games, slots, and other gaming services. These providers do not receive full personal profiles.
• IT and infrastructure providers: Cloud hosting, data storage, and cybersecurity service providers may process technical and usage data in the course of providing infrastructure services, subject to data processing agreements.
• Regulatory and law enforcement authorities: Where required by law, court order, or regulatory demand, we may disclose personal data to competent authorities. Togelon will only disclose the minimum data necessary to satisfy any such requirement.
• Business transfers: In the event of a merger, acquisition, or sale of all or a substantial part of Togelon's assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

Togelon uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyse usage patterns. The following categories of cookies are in use on the Platform:

• Strictly necessary cookies: Essential for core Platform functions such as authentication, session management, and security. These cannot be disabled without affecting Platform functionality.
• Performance and analytics cookies: Used to collect aggregate, anonymised data about how players navigate and interact with the Platform. This data is used to improve performance and user experience.
• Functional cookies: Used to remember your language preferences, display settings, and other personalisation choices.
• Marketing cookies: Used (with your consent) to deliver relevant promotional content and measure the effectiveness of marketing campaigns. You may opt out of marketing cookies at any time through your browser settings or the Platform's cookie preference centre.

You may control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Platform. Continued use of the Platform following the presentation of a cookie consent notice constitutes consent to the use of cookies described therein.

Togelon retains personal data for no longer than is necessary for the purposes for which it was collected, subject to any overiding legal or regulatory retention obligations. The following retention periods apply as general guideline:

• Active account data: Retained for the duration of your account's active status, plus a minimum of five (5) years following account closure — in compliance with AML and gaming licence record-keeping requirements.
• KYC documentation: Retained for a minimum of five (5) years from the date of verification, or longer if required by the specific licensing authority's regulations.
• Transaction records: Retained for a minimum of five (5) years for audit and AML compliance purposes.
• Customer support communications: Retained for two (2) years from the date of the last interaction, unless the subject matter of the communication requires a longer retention period.
• Marketing preferences and consent records: Retained until consent is withdrawn, plus one (1) year thereafter as evidence of consent management.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised such that it can no longer be associated with any identifiable individual.

As an internationally licensed platform serving Malaysian players, Togelon may transfer personal data to, and process it in, countries outside Malaysia — including the jurisdiction which Togelon's gaming licence is held and the locations of our cloud infrastructure and third-party processors.

Where personal data is transferred outside of Malaysia to countries that do not provide an equivalent level of data protection, Togelon implements appropriate safeguards, which may include contractual clauses requiring the recipient to maintain data protection standards equivalent to those described in this Policy.

Subject to applicable law, you have the following rights in relation to your personal data processed by Togelon. To exercise any of these rights, please contact our Data Protection team via the channels listed in Section 14.

• Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is being processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our overiding legal and regulatory retention obligations.
• Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format for transfer to another service provider, where technically feasible.
• Right to Object: You may object to the processing of your personal data on the basis of legitimate interests or for direct marketing purposes. Where you object to marketing, we will cease processing your data for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of any processing that took place before the withdrawal.

Togelon will respond to all verifiable data rights requests within thirty (30) calendar days of receipt. In complex cases, this period may be extended by a further two months, and you will be notified of any such extension within the initial thirty-day period.

Togelon employs appropriate technical and organisational security measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These measures include:

• TLS 1.3 encryption for all data transmitted between your device and the Platform.
• AES-256 encryption for sensitive data at rest, including KYC documentation and financial records.
• Access controls and role-based permissions limiting internal access to personal data to authorised personnel only.
• Multi-factor authentication for administrative access to data systems.
• Regular security assessments, penetration testing, and vulnerability scanning of Platform infrastructure.
• Comprehensive audit logging of all access to personal data stores.
• Staff training on data protection obligations and security protocols.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Togelon will notify affected players without undue delay and will take immediate steps to contain and remediate the breach.

You are also responsible for maintaining the security of your own Account credentials. Please do not share your password with any third party and contact our support team immediately if you suspect any unauthorised access to your Account.

The Togelon Platform is strictly intended for persons aged21 years and above. We do not knowingly collect, process, or retain personal data from individuals under the age of 21. The Platform is not directed at, and is not designed for use by, minors.

Where Togelon discovers or has reasonable cause to believe that personal data has been submitted by or on behalf of a person under 21, that data will be deleted immediately and the associated Account will be closed. If you are a parent or guardian and believe that your child has registered an Account on the Platform, please contact our support team immediately.

Togelon reserves the right to update or modify this Privacy Policy at any time in response to changes in applicable law, our data processing activities, the services we offer, or our business operations.

Where a material change is made to this Policy — for example, a new category of data being collected, a new purpose for which data is processed, or a new category of third-party recipient — we will notify registered players by email and/or by a prominent notice on the Platform no less than fourteen (14) days prior to the change taking effect.

The effective date at the top of this document reflects the date of the most recent revision. We encourage you to review this Policy periodically to stay informed about how Togelon protects your personal data. Continued use of the Platform following publication of a revised Policy constitutes your acceptance of the changes.

If you have any questions, concerns, or requests in relation to this Privacy Policy or the processing of your personal data, please contact the Togelon Data Protection team through the following channels:

• Live Chat: Available24 hours a day, 7 days a week directly through the Togelon Platform. State "Data Privacy Request" at the start of your chat to be routed to the appropriate team.
• Email: [email protected] — please use the subject line "Privacy Policy Enquiry" or "Data Rights Request" and include your registered username and Account email address for verification purposes.

Togelon is committed to resolving all privacy-related enquiries and data rights requests promptly and transparently. If you are not satisfied with our response to a privacy complaint, you may be entitled to escalate the matter to the relevant data protection authority in the jurisdiction in which Togelon holds its gaming licence.

For issues specifically related to responsible gambling data, account limits, or self-exclusion, please refer to our Responsible Gambling page for dedicated support resources and contact information.