Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how loto8 ("Company", "Platform", "we", "us", "our"), the operator of the online gaming platform accessible at loto8.cam, collects, uses, stores, discloses, and protects the personal data of individuals ("User", "you", "your") who access or use our services.

loto8 operates an online gaming platform that serves players including, but not limited to, users located in Malaysia. By registering an account, accessing the platform, or otherwise using any of our services — including live casino, video slots, sports betting, and related features — you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

This Policy should be read in conjunction with our Terms & Conditions, which govern your use of the loto8 platform and which incorporate this Policy by reference.

2 Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" means any information that identifies or can reasonably identify a natural person, directly or indirectly. This includes names, identification numbers, contact details, IP addresses, account credentials, and financial information.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction — whether automated or manual.
• "Data Controller" refers to loto8 in its capacity as the entity that determines the purposes and means by which Personal Data is processed.
• "Data Processor" refers to any third party that processes Personal Data on behalf of loto8 pursuant to a contractual arrangement.
• "KYC" means Know Your Customer — the identity and age verification procedures required to activate an account and process withdrawals.
• "Cookies" refers to small data files placed on your device by our platform to support functionality, analytics, and user experience improvements.

3 Personal Data We Collect

loto8 collects personal data through multiple channels as part of normal platform operation. The categories of personal data we collect are outlined below:

3.1 Registration & Account Data

When you create an account on loto8, we collect the information you provide directly:

3.2 Identity Verification (KYC) Data

To comply with our obligations under our operating licence and to enforce our 21+ age policy, we collect identity verification documents:

3.3 Financial & Transaction Data

In connection with deposits and withdrawals processed through payment methods such as Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX (Maybank, CIMB, Public Bank, Hong Leong), and cryptocurrencies:

We do not store full payment card numbers. Payment processing is handled by certified third-party payment service providers.

3.4 Technical & Usage Data

When you access the loto8 platform, we automatically collect certain technical data:

3.5 Communications Data

When you contact loto8 support via live chat, email, or any other communication channel, we retain records of those interactions including timestamps, the nature of the query, and any information you provide during the communication.

4 Purposes of Processing

loto8 processes your personal data for the following clearly defined purposes:

1. Account Registration & Management: To create and maintain your player account, authenticate your identity, and provide access to platform features.
2. KYC & Age Verification: To verify that you are at least 21 years of age and to comply with our operating licence requirements regarding player identity checks.
3. Payment Processing: To facilitate deposits and withdrawals via your chosen payment method, including verification that payment accounts are registered in your name.
4. Fraud Prevention & Security: To detect, investigate, and prevent fraudulent transactions, money laundering, account takeovers, and other prohibited activities.
5. Regulatory Compliance: To comply with applicable laws, licensing conditions, and legal obligations, including responding to lawful requests from regulatory authorities.
6. Platform Improvement: To analyse usage patterns, identify technical issues, and improve the features, security, and overall performance of the loto8 platform.
7. Customer Support: To respond to your queries, complaints, and requests efficiently and to maintain records of support interactions.
8. Responsible Gambling: To monitor gameplay patterns that may indicate problem gambling behaviour and to administer self-exclusion or account restriction requests.
9. Marketing Communications: Where you have provided consent, to send you information about promotions, bonuses, and platform updates. You may withdraw consent at any time by contacting support.

5 Legal Basis for Processing

loto8 processes personal data on the following legal grounds, consistent with internationally recognised data protection principles:

• Contract Performance: Processing necessary to perform our obligations under the Terms & Conditions you have agreed to, including operating your account and processing transactions.
• Legal Obligation: Processing required to comply with applicable laws, our licensing conditions, and instructions from competent regulatory authorities.
• Legitimate Interests: Processing necessary for our legitimate business interests, including fraud detection, security monitoring, and platform improvement — subject to those interests not overriding your fundamental rights.
• Consent: Where you have explicitly consented to a specific processing activity, such as the receipt of marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6 Third-Party Disclosure

loto8 does not sell your personal data. We may share personal data with carefully selected third-party service providers in the following categories, solely to the extent required for platform operation:

Category	Purpose of Disclosure
Payment Processors	Processing deposits and withdrawals via e-wallets, FPX bank rails, and cryptocurrency networks. These providers receive only the payment-relevant data required to complete the transaction.
KYC Verification	Identity document verification and age confirmation services. Providers are contractually bound to process data solely for verification purposes and not to retain documents beyond the required period.
Cloud Infrastructure	Secure hosting of platform data on enterprise-grade cloud infrastructure. Data is stored and processed under strict access controls and data processing agreements.
Fraud & Security	Risk scoring, device fingerprinting, and fraud detection services used to protect accounts and prevent money laundering or abusive activity on the platform.
Regulatory Authorities	Disclosure to our licensing authority or any competent legal authority where required by law, court order, or regulatory mandate. We will notify you of such requests where legally permitted to do so.

All third-party data processors engaged by loto8 are subject to contractual data protection obligations and are not permitted to use your personal data for their own purposes.

7 International Data Transfers

As an internationally operated platform, loto8 may process and store personal data on infrastructure located outside Malaysia. Where personal data is transferred to jurisdictions that may not have an equivalent level of data protection law as Malaysia, we implement appropriate safeguards including:

• Contractual clauses (data processing agreements) with all third-party processors that impose data protection obligations equivalent to those under this Policy.
• Restricting access to personal data to authorised personnel only, regardless of location.
• Applying encryption and access controls to data during transit and at rest across all jurisdictions.

8 Data Retention

loto8 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable laws and our licensing obligations. Specific retention guidelines are as follows:

• Active Account Data: Retained for the duration of the account's active status plus a minimum of five (5) years following account closure, to satisfy regulatory record-keeping requirements.
• KYC Documents: Retained for a minimum of five (5) years following the conclusion of the business relationship, as typically required under anti-money laundering obligations.
• Transaction Records: Retained for a minimum of five (5) years from the date of the transaction.
• Support Communications: Retained for three (3) years from the date of the interaction, unless a complaint or dispute requires longer retention.
• Marketing Consent Records: Retained until consent is withdrawn or for the duration required to demonstrate compliance with applicable consent obligations.

Upon expiry of the relevant retention period, personal data is securely deleted or anonymised in a manner that renders re-identification impossible.

9 Security Measures

loto8 implements a range of technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure:

• Encryption in Transit: All communications between your device and the loto8 platform are encrypted using industry-standard TLS/SSL protocols (256-bit).
• Encryption at Rest: Sensitive data stored on our infrastructure, including identity documents and financial information, is encrypted at rest.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Staff with data access undergo regular security training and are subject to confidentiality obligations.
• Two-Factor Authentication (2FA): Available for all player accounts and mandatory for internal administrative access to systems containing personal data.
• Security Monitoring: Our infrastructure is subject to continuous monitoring, intrusion detection, and regular third-party penetration testing.

Despite these measures, no system is completely impenetrable. In the event of a data breach that poses a risk to your rights and freedoms, loto8 will notify affected users and relevant authorities in accordance with applicable legal requirements.

10 Cookies & Tracking Technologies

loto8 uses cookies and similar tracking technologies on our platform for the following purposes:

10.1 Strictly Necessary Cookies

These cookies are essential for the platform to function and cannot be disabled. They include session authentication tokens that keep you logged in during your visit and security cookies that prevent cross-site request forgery.

10.2 Functional Cookies

These cookies remember your preferences and settings, such as your preferred language, to personalise your experience on loto8. Disabling these cookies may impair certain platform features.

10.3 Analytics Cookies

We use anonymised analytics tools to understand how users navigate the platform, which pages are most visited, and where technical issues occur. This data is aggregated and does not identify individual users. It helps us improve the loto8 experience for all players.

10.4 Managing Cookies

You may control cookie settings through your browser's privacy or settings menu. Blocking all cookies may affect platform functionality. Clearing cookies will log you out of your session and may reset saved preferences.

11 Your Data Rights

Subject to applicable law, you hold the following rights in relation to the personal data loto8 holds about you:

To exercise any of the above rights, please contact our support team via live chat or at the email address provided in Section 14. We will respond to all verified requests within 30 days. We may require identity verification before actioning a data request to ensure we are responding to the legitimate account holder.

12 Minors & Age Policy

loto8 strictly prohibits the use of our platform by persons under the age of 21. We do not knowingly collect personal data from individuals under 21 years of age. If we become aware that personal data has been collected from a minor, we will take immediate steps to delete that data and close the associated account.

If you believe that a minor has registered on loto8 or that we hold personal data relating to a person under 21, please contact our support team immediately so we can investigate and take appropriate action.

This platform is strictly for players aged 21 and above. 🔞

13 Changes to This Privacy Policy

loto8 reserves the right to update or modify this Privacy Policy at any time. Changes may be made to reflect updates to our data processing activities, changes in applicable law, or improvements to our privacy practices.

Where changes are material — meaning they significantly affect how we process your personal data or your rights under this Policy — we will provide notice to active account holders via the platform or via email prior to the changes taking effect. The updated Policy will be published on this page with a revised effective date.

Your continued use of the loto8 platform following the publication of any update to this Policy constitutes your acknowledgement of the revised terms. If you do not agree with any changes, you should cease using the platform and may request account closure through our support team.

14 Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us through the following channels:

• Live Chat Support: Available 24/7 directly through the loto8 platform. This is the fastest way to reach our team for privacy-related queries.
• Email (plain text — not a clickable link):
  [email protected]

For formal data subject access requests, erasure requests, or complaints regarding data processing, please use the email above and include "Data Privacy Request" in the subject line. We aim to acknowledge all formal privacy requests within 5 business days and to provide a substantive response within 30 calendar days.