Privacy Policy

This Privacy Policy ("Policy") is issued by Lotto88 ("the Company", "we", "us", "our") and applies to all personal data collected through the Lotto88 website and mobile-optimised platform accessible at lotto88.cam (the "Platform"), as well as through any associated communication channels including email correspondence and live chat interactions.

Lotto88 operates as an online gaming platform serving registered members in Malaysia and other permitted jurisdictions. In the course of providing our services — which include online casino games, sports betting (including EPL, Liga Super Malaysia, and other major sporting events), live dealer gaming, lottery products, and customer support — we necessarily collect and process certain personal data about our members.

This Policy is designed to inform you clearly and transparently about: what personal data we collect, the purposes for which we process it, the legal basis we rely upon, how long we retain it, who we share it with, and what rights you have as a data subject. We are committed to handling your personal information with the utmost care, discretion, and security.

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

Lotto88 collects the following categories of personal data, depending on how you interact with the Platform:

3.1 Registration & Identity Data

• Full legal name (as it appears on official identification documents)
• Date of birth (to verify you are aged 21 or above)
• Residential address, including city (e.g., Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam) and postcode
• Email address
• Mobile phone number
• Username and encrypted password
• National identity card number (MyKad) or passport number (for KYC verification)

3.2 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts in MYR and timestamps
• Payment method information, including bank name (e.g., Maybank, CIMB, Public Bank, Hong Leong), e-wallet identifiers (Touch 'n Go eWallet, Boost, GrabPay), and FPX or DuitNow reference numbers
• Cryptocurrency wallet addresses (where applicable for BTC or USDT transactions)
• Account balance history

3.3 Gaming & Betting Activity Data

• Wagering history, including game titles, bet amounts, outcomes, and session durations
• Sports betting selections, including markets and odds accepted
• Bonus and promotional activity records
• Responsible gambling tool settings (deposit limits, self-exclusion status)

3.4 Technical & Device Data

• IP address and approximate geolocation derived from IP
• Device type, operating system, and browser type and version
• Session timestamps, login history, and duration of Platform use
• Cookie identifiers and similar tracking technologies (see Section 8)

3.5 Communication Data

• Records of live chat and email correspondence with our support team
• Support ticket content and resolution history
• Marketing communication preferences and opt-in / opt-out history

Lotto88 collects personal data through the following methods:

• Direct provision: Information you actively submit during account registration, KYC document uploads, deposit and withdrawal requests, contact form submissions, and live chat conversations.
• Automated collection: Technical data collected automatically as you browse and interact with the Platform — including through cookies, web beacons, server logs, and similar technologies.
• Third-party sources: Identity verification data from KYC service providers; fraud-detection signals from payment processors; geolocation data from IP resolution services. Data received from third parties is handled in accordance with this Policy.
• Payment processors: Transaction confirmation data relayed from Malaysian payment rails including FPX, DuitNow, and e-wallet operators to process and verify your deposits and withdrawals.

Lotto88 processes your personal data for the following specific purposes:

Lotto88 does not use your personal data for any purpose not listed above without first notifying you and, where required, obtaining your prior consent.

Lotto88 processes personal data on the following legal grounds, depending on the purpose of processing:

• Contractual necessity: Processing required to fulfil our contractual obligations to you under the Terms and Conditions — including account management, payment processing, and service delivery.
• Legal obligation: Processing required to comply with applicable legal and regulatory requirements, including KYC identity verification, AML reporting obligations, and responsible gambling compliance.
• Legitimate interests: Processing necessary for Lotto88's legitimate business interests, including fraud detection, platform security, and analytics — provided such interests are not overridden by your fundamental rights and freedoms.
• Consent: Processing for which we have obtained your explicit prior consent — primarily for marketing communications and optional personalisation features. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Lotto88 does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes. We may share your personal data with third parties only in the following carefully defined circumstances:

7.1 Service Providers

We engage trusted third-party service providers to support our operations. These include: payment gateway and financial processing partners (including operators of Malaysian payment infrastructure such as FPX, DuitNow, and e-wallet platforms); KYC and identity verification providers; fraud detection and cybersecurity providers; cloud hosting and infrastructure providers; and customer support tools. All such service providers are contractually bound to process personal data only on our instructions and in accordance with applicable data protection standards.

7.2 Legal & Regulatory Authorities

We may disclose personal data to government authorities, law enforcement agencies, regulators, or courts where we are legally required to do so — for example, in connection with AML investigations, regulatory audits, or court orders. We will only disclose the minimum data necessary to satisfy the legal requirement.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of the Company's assets, personal data held by Lotto88 may be transferred to the relevant successor entity. In such circumstances, we will provide advance notice to affected members and ensure that the acquiring entity commits to maintaining equivalent data protection standards.

The Lotto88 Platform uses cookies and similar tracking technologies to provide core functionality, improve your experience, and support our analytics and security operations. The following types of cookies are used:

• Essential cookies: Required for the Platform to function correctly, including session management, login authentication, and security token validation. These cannot be disabled without impairing Platform functionality.
• Performance cookies: Used to collect anonymised analytics data about how users interact with the Platform — pages visited, session duration, and navigation paths. This data is used solely to improve the Platform's design and performance.
• Functional cookies: Used to remember your preferences, such as language settings, display preferences, and responsible gambling tool configurations.
• Fraud prevention cookies: Used to detect suspicious activity, multiple account creation attempts, and patterns consistent with bonus abuse or unauthorised access.

You may manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of some Platform features. Lotto88 does not use third-party advertising or behavioural tracking cookies for the purpose of serving targeted advertisements on external websites.

Lotto88 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal obligations. Our standard retention schedules are as follows:

Upon expiry of the applicable retention period, personal data is securely deleted or permanently anonymised so that it can no longer be linked to any identifiable individual. Members who have requested account closure will have their data processed in accordance with the above schedule from the account closure date.

Lotto88 implements a comprehensive set of technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• 256-bit SSL/TLS encryption on all data transmitted between your device and our servers — the same standard used by major Malaysian financial institutions including Maybank and CIMB;
• Encrypted storage for all sensitive data fields at rest, including passwords (stored as salted hashes) and identity document data;
• Access controls limiting personal data access to only those staff members with a legitimate operational need, subject to role-based permission management;
• Regular penetration testing and security audits conducted by independent cybersecurity professionals;
• Intrusion detection systems and continuous server monitoring to identify and respond to suspicious access patterns;
• Two-factor authentication (2FA) available to all members for additional account protection.

In the event of a personal data breach that poses a risk to your rights and freedoms, Lotto88 will notify affected members and relevant authorities within the timeframes required by applicable law.

As a data subject, you have the following rights in relation to the personal data Lotto88 holds about you. To exercise any of these rights, please contact our support team at [email protected]. We will respond to all valid requests within 30 calendar days.

11.1 Right of Access

You have the right to request a copy of the personal data Lotto88 holds about you, together with information about how and why it is processed.

11.2 Right to Rectification

You have the right to request correction of any inaccurate or incomplete personal data held about you. Minor corrections (e.g., contact details) can often be made directly within your account settings.

11.3 Right to Erasure

You may request deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the original purpose, or where you have withdrawn consent. Please note that certain data must be retained for legal compliance purposes (see Section 9) and cannot be deleted on request alone.

11.4 Right to Restrict Processing

You have the right to request that we restrict processing of your data in certain circumstances, such as where you contest the accuracy of the data or object to our processing while we investigate your objection.

11.5 Right to Data Portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

11.6 Right to Object

You have the right to object to processing based on legitimate interests, including for direct marketing purposes. Where you object to marketing communications, we will honour the request promptly and no later than within 10 working days.

11.7 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.

The Lotto88 Platform is strictly intended for individuals who are at least 21 years of age. We do not knowingly collect, process, or retain personal data from any individual under the age of 21. This policy is consistent with the minimum age requirements applied by internationally licensed gaming operators.

Age verification is a mandatory step in our KYC process, and we reserve the right to request documentary proof of age from any member at any time. If we become aware that personal data has been collected from an individual below the required age threshold, we will immediately suspend the relevant account and permanently delete all associated personal data, subject to any minimum retention obligations required by law.

If you have reason to believe that a minor has registered on the Platform using false information, please contact us immediately at [email protected] so that we may take appropriate action without delay.

Some of our service providers — including cloud infrastructure, cybersecurity, and KYC verification partners — may be located in or operate infrastructure in jurisdictions outside of Malaysia. Where personal data is transferred to such jurisdictions, Lotto88 takes appropriate steps to ensure that the transfer is lawful and that the receiving party maintains data protection standards equivalent to those described in this Policy.

Protective measures employed for international transfers include contractual data processing agreements containing standard data protection clauses, as well as technical safeguards including end-to-end encryption of transferred data. Lotto88 does not transfer personal data to jurisdictions that do not provide an adequate level of data protection without first implementing appropriate safeguards.

The Lotto88 Platform may contain references to or integrations with third-party services — such as payment processors, game providers, and live streaming services. Where you interact with third-party services through the Platform, those parties operate under their own privacy policies and data practices, which are separate from and independent of this Policy.

Lotto88 is not responsible for the privacy practices of any third-party service provider. We recommend that you review the privacy policies of any third parties whose services you access in conjunction with Lotto88, particularly payment providers such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, or your bank.

Lotto88 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform services. When material changes are made, we will update the "Last Updated" date at the top of this page and, where the changes are significant, notify registered members via email or prominent in-Platform notice at least 7 calendar days before the changes take effect.

We encourage you to review this Policy periodically to stay informed about how we protect your personal data. Your continued use of the Platform following any amendment constitutes your acknowledgement of the revised Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way Lotto88 handles your personal data, please contact our Data Protection team through any of the following channels:

• Email: [email protected] — marked "Privacy Request" in the subject line for faster routing
• Live Chat: Available 24/7 via the Platform — ask to be connected to the Data Protection team for formal requests

We are committed to responding to all privacy-related enquiries within 5 working days and to completing formal data rights requests within 30 calendar days of receipt. For complex requests, we may require an additional 30 days, in which case we will notify you of the extension and the reasons for it.