Privacy Policy to303 – Personal Data Protection for Malaysian Members

1 Privacy Policy Introduction & Scope

To303 ("we", "the Company") is committed to protecting the privacy and security of the personal data of every individual who uses our platform at to303.fun. This Privacy Policy ("Policy") describes our practices regarding the collection, processing, storage, and disclosure of your personal data as a registered member or visitor of the to303 platform.

This policy applies to all services offered by to303, including the to303.fun website, the to303 mobile app, and all our official communication channels. By using any to303 service, you agree to the collection and use of information as described in this Policy.

2 Personal Data We Collect

To303 only collects personal data that is genuinely necessary to provide members with a safe, fair, and quality service. The following are the categories of data we collect:

To303 does not collect irrelevant or excessive information. We do not request credit card numbers directly — all payments are processed through secure, PCI-DSS compliant payment gateways.

3 How We Use Your Personal Data

Personal data collected by to303 is used solely for legitimate and stated purposes. We do not use your data for any other purpose without first obtaining your consent. The purposes for which data is used are as follows:

• Account Management: Creating, verifying, and managing your member account on the to303 platform.
• Transaction Processing: Processing deposits, withdrawals, and all financial transactions related to your account.
• KYC Verification: Fulfilling legal obligations related to identity verification to prevent money laundering and terrorist financing.
• Customer Support: Providing assistance and resolving complaints or enquiries you submit.
• Platform Security: Detecting and preventing fraud, multi-account use, and other unauthorised activity.
• Responsible Gaming: Monitoring gameplay patterns to identify members who may need assistance and to enforce set limits.
• Service Improvement: Analysing platform usage to improve the user experience and resolve technical issues.
• Marketing Communications: Sending information about promotions and bonuses — only if you have consented to receive such communications.

To303 only processes your data where a valid legal basis exists, whether for the performance of a contract, compliance with a legal obligation, the company's legitimate interests, or consent you have provided.

4 Data Sharing & Disclosure

To303 does not sell, rent, or transfer your personal data to third parties for their own marketing purposes. However, there are certain situations where to303 needs to share your data with specific parties:

• Payment Service Providers: Payment gateways and e-wallet providers involved in processing your deposits and withdrawals. All such providers are bound by strict confidentiality agreements.
• Technology Service Providers: Companies providing technical infrastructure, cloud services, and cybersecurity tools to support the operation of the to303 platform.
• Regulatory Authority: Law enforcement bodies, government agencies, or courts when to303 is legally required to disclose information.
• KYC Service Providers: Third-party identity verification companies integrated with the to303 platform to streamline the member verification process.
• Game Providers: Gaming companies that provide slots, live casino, and sports content to the to303 platform, limited to technically necessary data only.

5 Data Security & Protection Measures

To303 implements a comprehensive multi-layered security framework to protect your personal data from unauthorised access, alteration, disclosure, or destruction. Key security measures we implement include:

• 256-bit SSL Encryption: All communications between your device and to303's servers are encrypted using the latest TLS protocol.
• Data Encryption at Rest: Sensitive data stored in to303's databases, including financial information, is encrypted using AES-256 encryption algorithms.
• Role-Based Access Control: Only staff who require access to specific data to perform their duties are permitted to do so.
• Two-Factor Authentication (2FA): All internal admin accounts are protected with mandatory 2FA. Members are also encouraged to enable 2FA on their accounts.
• 24/7 Security Monitoring: Automated monitoring systems track suspicious activity on the to303 platform around the clock.
• Regular Security Audits: to303 conducts regular penetration testing and independent security audits to identify and address vulnerabilities.

6 Cookies, Tracking & Similar Technologies

To303 uses cookies and similar tracking technologies to enhance the user experience, analyse platform performance, and deliver more relevant content. The following are the types of cookies used:

• Essential Cookies: Required for core platform operations, including login authentication and session security. These cookies cannot be disabled.
• Preference Cookies: Saving your preferences such as language, time zone, and display layout to streamline your platform experience.
• Analytical Cookies: Helping to303 understand how members use the platform — pages visited, time spent, and navigation patterns — for improvement purposes.
• Marketing Cookies: Used to display relevant advertisements and promotions to you. These cookies are only activated with your consent.

You can manage your cookie preferences through your web browser settings. Please note that disabling certain cookies may affect the functionality of the to303 platform. For more granular cookie control, access the privacy settings panel in your to303 account.

7 Your Rights Regarding Personal Data

As a data subject under Malaysia's PDPA, you have the following rights regarding the personal data that to303 holds about you:

To submit any request regarding your data rights, contact to303's Data Privacy Officer via email at [email protected]. to303 will process your request within 14 working days and may require identity verification before the request is processed.

8 Data Retention & Deletion

To303 does not retain your personal data longer than necessary for the purposes stated in this Policy, or beyond the period required by Malaysian law.

• Active Account Data: Retained for as long as your account remains active on the to303 platform.
• Financial Transaction Data: Retained for a minimum of 7 years in accordance with Malaysia's accounting and anti-money laundering legal requirements.
• KYC Data: Retained for a minimum of 5 years after account closure, in line with applicable anti-money laundering regulations.
• Support Communication Logs: Retained for 2 years for quality control and dispute resolution purposes.
• Technical & Log Data: Retained for 90 days for security and technical debugging purposes.

Upon expiry of the applicable retention period, your data will be securely deleted or anonymised so that it can no longer be personally associated with you.

9 Children's Data Protection

To303 services are strictly for individuals aged 18 and above. to303 does not knowingly collect personal data from individuals under the age of 18.

10 Cross-Border Data Transfers

In the course of its operations, to303 may transfer your personal data to servers or processing facilities located outside Malaysia. Such transfers are only carried out when:

• The recipient country provides a level of data protection adequate and equivalent to Malaysia's PDPA.
• To303 has enforced appropriate contractual protections with data recipients outside the country.
• Such transfers are required for the performance of a contract between you and to303, such as processing international payments.

To303 ensures that all cross-border data transfers are carried out in full compliance with Malaysia's PDPA requirements and that adequate protections are always in place to safeguard your data.

11 Changes to This Privacy Policy

To303 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our practices, legal requirements, or service improvements. When material changes are made, to303 will:

• Updating the "Last Updated" date at the top of this document.
• Displaying a clear notice on the to303 platform homepage for a minimum of 14 days.
• Sending email notifications to all registered members for material and significant changes.

We encourage you to review this Privacy Policy periodically. Continued use of the to303 platform after any changes take effect will be considered acceptance of the updated terms.

12 Contact Our Data Privacy Officer

If you have any questions, concerns, or complaints regarding this Privacy Policy or how to303 manages your personal data, please contact our Data Privacy Officer:

To303 takes every privacy complaint seriously and will investigate and respond to all complaints submitted in a transparent and fair manner. If you are not satisfied with our response, you have the right to lodge a complaint with Malaysia's Department of Personal Data Protection.