Privacy Policy

This Privacy Policy ("Policy") issued by to188 ("we", "us", "our") and applies to all personal data collected through the to188 platform at https://to188.lat, including all associated web pages, mobile-optimised interfaces, and support channels.

to188 is operated under international online gambling licensing. We process personal data in accordance with the obligations imposed by our licensing jurisdiction and in alignment with internationally recognised data protection principles, including those set out in the General Data Protection Regulation (GDPR) framework, which we adopt voluntarily as a benchmark for data handling standards.

This Policy governs our data practices in relation to all users of the to188 platform, including players based in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and other locations throughout Malaysia. By registering an account on to188 and by continuing to use our services, you consent to the data practices described in this Policy.

For the purposes of this Privacy Policy, the following terms shall have the meanings assigned below:

• "Personal Data" means any information that identifies or can identify a natural person, either directly (e.g., full name, government ID number) or indirectly (e.g., IP address, device identifiers combined with other data).
• "Processing" means any operation performed on Personal Data, including collection, storage, use, transmission, disclosure, alteration, erasure, or any combination thereof.
• "Data Controller" means to188, the entity that determines the purposes and means of processing Personal Data.
• "Data Processor" means any third-party service provider that processes Personal Data on behalf of to188 under a written data processing agreement.
• "User or "Data Subject" means any individual who registers an account on, or otherwise interacts with, the to188 platform.
• "KYC" means Know Your Customer — the identity and age verification process applied to all188 accounts prior to withdrawal processing.
• "Cookie" means a small text file placed on your device by the to188 platform for session management, security, or analytics purposes.
• "Consent" means a freely given, specific, informed, and unambiguous indication of the Data Subject's agreement to the processing of their Personal Data.

to188 collects the following categories of Personal Data in the course of providing our services:

Personal Data collected by to188 is used for the following purposes:

• Account creation and management: To register your account, maintain your user profile, and enable access to the platform's services.
• Identity and age verification (KYC): To verify that all users are aged 21 or above, comply with anti-money laundering obligations, and confirm the legitimacy of payment methods.
• Transaction processing: To process deposits via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank, CIMB, Public Bank, Hong Leong Bank, or cryptocurrency, and to process withdrawal requests to verified accounts.
• Fraud detection and security: To identify, investigate, and prevent fraudulent activity, unauthorised account access, and money laundering.
• Platform improvement: To analyse aggregated behavioural and technical data to improve game performance, identify technical faults, and optimise the user experience.
• Customer support: To respond to support requests, resolve disputes, and manage formal complaints.
• Responsible gambling: To monitor usage patterns that may indicate problem gambling behaviour, apply self-exclusion preferences, and enforce player-imposed limits.
• Legal compliance: To fulfil obligations imposed by our international licensing authority and applicable anti-money laundering regulations.
• Marketing communications: To send promotional offers, bonus notifications, and platform updates to users who have opted in to receive such communications. You may opt out at any time.

to188 processes your Personal Data on the following legal bases:

• Contractual necessity: Processing of Identity Data, Contact Data, and Financial Data is necessary to perform the contract you enter into with us when you create an account and use our services.
• Legal obligation: KYC verification, anti-money laundering checks, and record-keeping for regulatory compliance purposes are required by our licensing obligations and constitute processing on the basis of legal obligation.
• Legitimate interests: Processing of Technical Data and Behavioural Data for fraud prevention, platform security, and aggregate performance analytics is carried out on the basis of to188's legitimate interests — provided those interests are not overridden by your fundamental rights.
• Consent: Processing of your data for direct marketing communications is conducted on the basis of your explicit opt-in consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

to188 does not sell, rent, or trade your Personal Data to any third party for commercial or marketing purposes. We share your data only in the following limited and necessary circumstances:

• Payment processors: Financial Data is shared with our payment processing partners — including e-wallet providers such as Touch 'n Go, Boost, and GrabPay, and banking partners including Maybank, CIMB, Public Bank, and Hong Leong — solely to facilitate deposit and withdrawal transactions. These partners are bound by their own regulatory obligations and data processing agreements with to188.
• KYC and identity verification providers: Identity Data and document images may be shared with licensed third-party identity verification service providers to fulfil our age verification and anti-money laundering obligations.
• Game technology providers: Aggregated, pseudonymised session data may be shared with game providers to support game performance monitoring. No individually identifiable data is shared with game providers without your knowledge.
• Fraud prevention and security services: Technical Data and behavioural signals may be shared with fraud prevention platforms to detect and prevent account abuse.
• Regulatory and legal authorities: to188 will disclose Personal Data to competent regulatory, law enforcement, or legal authorities where required to do so by a valid legal obligation, court order, or the requirements of our licensing jurisdiction.

to188 retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, and licensing obligations. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account plus minimum of five (5) years following account closure, to satisfy anti-money laundering record-keeping requirements.
• Transaction and financial records: Retained for a minimum of five (5) years from the date of each transaction in accordance with standard financial record-keeping obligations.
• Communications and support records: Retained for three (3) years from the date of the communication, or longer where the subject matter relates to a dispute or investigation still in progress.
• Technical and behavioural data: Retained in identifiable form for up to twelve (12) months. After this period, data is aggregated and anonymised for statistical analysis.
• Marketing consent records: Retained for the duration of your consent plus two (2) years after withdrawal, to demonstrate compliance with consent obligations.

Upon expiry of the applicable retention period, Personal Data is securely deleted using industry-standard erasure methods, or rendered permanently anonymous so that it can no longer be attributed to any individual.

to188 uses cookies and similar technologies to ensure the proper functioning of the platform, maintain your session, and improve overall performance. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for platform operation. These include session cookies that maintain your logged-in state, security tokens, and cookies that remember your language preferences. These cannot be disabled without impairing core platform functionality.
• Performance & Analytics Cookies: Used to collect aggregated, anonymised data about how users interact with the to188 platform — such as page load times, error rates, and feature usage patterns. This data is used solely to improve the platform.
• Functional Cookies: Used to remember your preferences such as display settings or notification preferences to personalise your experience within the platform.

to188 does not deploy third-party advertising cookies or cross-site tracking technologies. We do not participate in behavioural advertising networks.

to188 implements a layered set of technical and organisational security measures to protect your Personal Data against unauthorised access, accidental loss, destruction, and disclosure. These measures include:

• 256-bit TLS/SSL encryption for all data in transit between your device and to188 servers;
• Encryption of sensitive data at rest within our database infrastructure;
• Role-based access controls restricting staff access to Personal Data on a strict need-to-know basis;
• Two-factor authentication available to all users and enforced for all administrative staff;
• Regular security assessments and penetration testing of platform infrastructure;
• Incident response procedures including user notification protocols in the event of a qualifying data breach.

Notwithstanding these measures, no digital system can guarantee absolute security. You are responsible for maintaining the confidentiality of your own account credentials. to188 will never contact you to request your password and will never send you links asking you to log in via an unsolicited email.

As a data subject, you hold the following rights with respect to the Personal Data we hold about you. To exercise any of these rights, submit a written request to our support team at the contact details provided in Section 14: