Privacy Policy

01Introduction

lotto9 (referred to in this Policy as "we", "us", "our", or the "Company") operates the online casino and sports betting platform accessible at lotto9.lat (the "Platform"). We are committed to protecting the privacy and personal data of all individuals who use our Platform, including registered players based across Malaysia — in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam, and beyond.

This Privacy Policy (the "Policy") describes:

• the categories of personal data we collect from you;
• the purposes for which we process that data;
• the legal bases on which we rely to process your data;
• with whom we share your data and why;
• how long we retain your data; and
• the rights you hold in respect of your personal data and how to exercise them.

By registering an account on lotto9 or otherwise using our Platform, you acknowledge that you have read and understood this Policy. This Policy forms part of our broader legal framework alongside our Terms & Conditions and our Responsible Gambling policy.

02Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person, including name, identification number, date of birth, contact details, and financial data.
• "Processing" — any operation performed on Personal Data, including collection, recording, storage, use, transmission, deletion, or destruction.
• "Data Controller" — lotto9, as the entity that determines the purposes and means of processing your Personal Data.
• "Data Processor" — a third party that processes Personal Data on behalf of lotto9 under a written data processing agreement.
• "Player" / "User" / "You" — any natural person who accesses, registers on, or interacts with the lotto9 Platform.
• "KYC Data" — identity and age verification documents submitted by a Player, including MyKad scans, passport copies, and proof of address.
• "Cookies" — small data files placed on your device by our Platform to enable functionality, analytics, and personalisation.

03Data We Collect

lotto9 collects Personal Data across the following categories:

04How We Collect Data

We collect Personal Data through the following means:

• Direct submission: Information you provide when registering an account, completing KYC, making a deposit or withdrawal, contacting support, or claiming a promotion.
• Automated technologies: Technical and usage data collected automatically as you interact with the Platform, including through cookies, server logs, and analytics tools.
• Third-party payment providers: Transaction confirmations and fraud signals received from Supported Payment Methods, including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, and Hong Leong Bank.
• Identity verification services: Confirmation data returned from KYC service providers following document verification.
• Anti-fraud and compliance databases: We may cross-reference data against publicly available sanctions, politically exposed persons (PEP), and adverse media databases as required by our compliance obligations.

05How We Use Your Data

lotto9 processes your Personal Data for the following purposes:

1. Account management: Creating, maintaining, and securing your player account, including password recovery and two-factor authentication.
2. Identity and age verification: Confirming that you meet the minimum age requirement of 21 years and that your identity matches the information provided at registration.
3. Payment processing: Executing deposit and withdrawal transactions through your chosen Supported Payment Method, including DuitNow, FPX, and major Malaysian bank transfers.
4. Regulatory compliance: Fulfilling our obligations under applicable anti-money laundering (AML), counter-financing of terrorism (CFT), and know-your-customer (KYC) requirements.
5. Fraud prevention and security: Detecting, investigating, and preventing fraudulent activity, unauthorised account access, money laundering, and abuse of promotional offers.
6. Responsible gambling: Monitoring gameplay patterns to identify signs of problem gambling behaviour and applying player-requested limits, reminders, or self-exclusion measures.
7. Platform improvement: Analysing aggregated usage data to improve game selection, user interface design, and platform performance.
8. Customer support: Responding to queries, resolving disputes, and maintaining records of communications for quality assurance.
9. Marketing communications: Sending promotional offers, bonus notifications, and platform updates to players who have not opted out of marketing communications.
10. Legal proceedings: Establishing, exercising, or defending legal claims arising out of or related to your use of the Platform.

06Legal Basis for Processing

lotto9 processes your Personal Data on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and lotto9 — including account operation, payment processing, and bonus management.
• Legal obligation: Processing required to comply with applicable laws, including AML/CFT regulations, KYC requirements, and financial reporting obligations.
• Legitimate interests: Processing carried out in pursuit of our legitimate business interests, including fraud prevention, platform security, and responsible gambling monitoring — where such interests are not overridden by your fundamental rights.
• Consent: Processing for marketing communications, where we rely on your prior opt-in consent. You may withdraw this consent at any time.

07Data Sharing & Disclosure

lotto9 does not sell, rent, or trade your Personal Data to any third party. We may share your data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment service providers: Processors facilitating deposits and withdrawals, including banks, e-wallet operators (Touch 'n Go eWallet, Boost, GrabPay), and cryptocurrency exchange gateways.
• KYC and identity verification providers: Third-party services used to verify identity documents and screen against sanctions and PEP databases.
• Fraud prevention services: Shared intelligence services used to detect and prevent fraudulent account activity.
• IT infrastructure and cloud service providers: Hosting, database management, and security service providers who process data on our behalf under strict data processing agreements.
• Customer support platforms: Third-party live chat or ticketing systems used to manage player support communications.
• Legal and regulatory authorities: Government agencies, regulators, law enforcement bodies, or courts where required by law or in response to a valid legal request.
• Professional advisers: Lawyers, auditors, and accountants where required in the context of legal, financial, or compliance matters.

08Cookies & Tracking Technologies

lotto9 uses cookies and similar tracking technologies on the Platform to ensure core functionality, measure performance, and improve the player experience.

8.1 Types of Cookies We Use

• Essential cookies: Required for the Platform to function. They enable session management, authentication, and security features. These cannot be disabled without affecting core Platform functionality.
• Analytics cookies: Used to collect anonymised data about how players navigate and use the Platform, helping us identify areas for improvement.
• Functional cookies: Remember your preferences such as language settings, display options, and last-used payment method to improve your experience.
• Marketing cookies: Track your interaction with promotional content. These are only active where you have provided consent.

8.2 Managing Cookies

You may control or disable non-essential cookies through your browser settings or our on-site cookie preference centre. Note that disabling essential cookies may impair or prevent your ability to use the Platform. Detailed instructions for managing cookies in major browsers are available from each browser's official documentation.

09Data Retention

lotto9 retains Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. Our general retention periods are as follows:

• Account data and transaction records: Retained for a minimum of five (5) years following account closure, as required by AML and financial record-keeping obligations.
• KYC documentation: Retained for a minimum of five (5) years following the end of the business relationship.
• Support communications: Retained for two (2) years unless required for ongoing dispute resolution or legal proceedings.
• Technical and usage logs: Retained for up to twelve (12) months for security and fraud investigation purposes.
• Marketing consent records: Retained for the duration of the marketing relationship and for one (1) year thereafter.

Upon expiry of the applicable retention period, Personal Data is either securely deleted or anonymised such that it can no longer be linked to an identifiable individual.

10Data Security

lotto9 implements a range of technical and organisational measures to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and our servers;
• Encryption of sensitive data fields at rest, including financial account details;
• Role-based access controls limiting internal access to Personal Data on a strict need-to-know basis;
• Two-factor authentication (2FA) available for all player accounts and mandatory for internal administrative systems;
• Regular penetration testing and security audits conducted by independent third-party specialists;
• Incident response procedures to detect, contain, and report data breaches in accordance with applicable notification requirements.

11Your Rights

Subject to applicable law, you hold the following rights in respect of your Personal Data held by lotto9:

To exercise any of the above rights, please contact us using the details in Section 15 (Contact Us) below. We will respond to all verified requests within 30 calendar days. We may need to verify your identity before processing your request to protect against unauthorised access.

You also have the right to lodge a complaint with a competent data protection supervisory authority in your jurisdiction if you believe that our processing of your Personal Data infringes applicable data protection law.

12Protection of Minors

If you are a parent or guardian and believe that a person under 21 years of age has accessed or registered on the lotto9 Platform, please contact us immediately using the details in Section 15 below. We will investigate and take prompt remedial action.

For guidance on parental controls and responsible gambling tools available to registered players, please visit our Responsible Gambling page.

13Third-Party Links

The lotto9 Platform may contain references to the services of third-party payment providers (such as Touch 'n Go eWallet, Boost, GrabPay, and Malaysian banking institutions). Any interaction you have with those third-party services is governed by their own privacy policies and terms of service. lotto9 has no responsibility or liability for the data practices of third-party service providers, and we encourage you to review their respective privacy notices before submitting any personal information to them.

14Policy Amendments

lotto9 reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, Platform functionality, or applicable law. The "Last updated" date at the top of this document will be revised whenever a material change is made.

Where changes are material — meaning they substantially affect how we collect, use, or share your Personal Data — we will notify registered players by email at least 14 days before the revised Policy takes effect. Your continued use of the Platform following that notification period constitutes your acceptance of the updated Policy.

15Contact Us

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or need to report a concern about how your Personal Data is being handled, please contact our Data Protection team through the following channel:

When contacting us in respect of a data subject right, please include your full name, registered email address, and a description of your request or concern. We may need to verify your identity before we can act on your request.

For general queries about the Platform, please visit our FAQ or About Us pages. For responsible gambling support, please visit our dedicated Responsible Gambling page.