Privacy Policy

1 Introduction

This Privacy Policy ("Policy") is issued by iLotto ("iLotto", "We", "Us", "Our"), the operator of the online betting and live casino platform accessible at https://ilotto.cam. This Policy governs the collection, processing, storage, disclosure, and protection of personal data relating to all registered players, website visitors, and prospective users ("Data Subject", "You", "Your") of the iLotto platform.

iLotto is committed to handling personal data with the highest standards of care, transparency, and security. We collect only the data necessary to deliver our services, comply with applicable legal and regulatory obligations, and provide a safe, fair gaming environment for all Malaysian players.

By accessing the iLotto platform, creating a player account, or continuing to use our services following publication of this Policy, you acknowledge that you have read and understood how iLotto processes your personal data as described herein. If you do not agree with any provision of this Policy, please discontinue use of the platform and contact our support team to request account closure.

2 Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• "Personal Data" — any information relating to an identified or identifiable natural person, including but not limited to name, identification number, email address, IP address, transaction history, and device identifiers.
• "Processing" — any operation performed on personal data, including collection, recording, storage, alteration, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — iLotto, as the entity that determines the purposes and means of processing personal data collected through the platform.
• "Data Processor" — any third-party service provider engaged by iLotto to process personal data on iLotto's behalf and under iLotto's documented instructions.
• "KYC Data" — identity verification documents submitted by a User pursuant to iLotto's Know Your Customer process, including Malaysian IC (MyKad), passport copies, proof of address, and payment method verification materials.
• "Cookies" — small text files stored on a User's device by the iLotto website that record browsing preferences, session data, and analytical information.
• "AML" — Anti-Money Laundering; the legal framework and internal procedures designed to detect and prevent the use of the iLotto platform for money laundering or financial crime.

3 Personal Data We Collect

iLotto collects the following categories of personal data in connection with your use of the platform:

• Full legal name and date of birth
• Malaysian National Identity Card number (MyKad) or passport number
• Residential address (including city — e.g., Kuala Lumpur, Petaling Jaya, Penang, Johor Bahru, Shah Alam)
• Email address and mobile phone number
• Security credentials (password stored in hashed/encrypted form only; never in plain text)

• Deposit and withdrawal amounts and timestamps
• Payment method identifiers (e.g., registered mobile number associated with Touch 'n Go eWallet or Boost; bank account number suffix for Maybank, CIMB, Public Bank, Hong Leong; DuitNow / FPX reference identifiers; partial card details for Visa/Mastercard)
• Cryptocurrency wallet addresses used for BTC or USDT transactions
• Transaction history and account balance records

• Bets placed, game sessions, and wager amounts
• Win/loss records and bonus utilisation history
• Sports betting selections and in-play activity
• Responsible gambling tool settings (deposit limits, session reminders, self-exclusion status)

• IP address and approximate geographic location at login
• Device type, operating system, browser type, and version
• Session timestamps, login history, and access logs
• Cookie identifiers and tracking pixel data (where applicable)

• Customer support chat transcripts and email correspondence
• Feedback, complaint records, and dispute submissions
• Marketing communication preferences and opt-in/opt-out records

4 How We Collect Personal Data

iLotto collects personal data through the following channels:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal request, contact customer support, respond to surveys, or submit a responsible gambling tool request.
• Automatically through the platform — via server logs, cookies, tracking technologies, and session monitoring software that record your interactions with the iLotto website and gaming platform.
• From payment service providers — when you initiate a financial transaction, your payment provider (e.g., Touch 'n Go, Boost, Maybank, CIMB, DuitNow network) shares transaction confirmation data with iLotto to complete the deposit or withdrawal.
• From third-party identity verification services — where iLotto uses accredited third-party KYC and AML screening services to verify your identity and screen against sanctions or watchlists.
• From analytics providers — where anonymised or pseudonymised data is collected via web analytics tools to help iLotto understand platform usage patterns and improve user experience.

5 Data Processing Purposes

iLotto processes personal data for the following specific purposes:

• Account Management: To create, maintain, and administer your iLotto player account, including processing login authentication, managing account settings, and communicating account-related notices.
• Payment Processing: To process deposits and withdrawals via your chosen payment method, including communicating transaction status and resolving payment disputes.
• Identity Verification (KYC): To verify your identity and age in compliance with applicable regulations, including screening your details against relevant databases to prevent identity fraud and underage access.
• AML & Fraud Prevention: To monitor transaction patterns and gaming behaviour for indicators of money laundering, fraud, collusion, bonus abuse, or other prohibited conduct as defined in our Terms & Conditions.
• Responsible Gambling: To administer responsible gambling tools you have activated (deposit limits, self-exclusion, session reminders), monitor for problem gambling indicators, and intervene where appropriate.
• Customer Support: To respond to your support queries, resolve disputes, and maintain records of communications for quality assurance and regulatory compliance purposes.
• Platform Improvement: To analyse aggregated usage data, identify technical issues, and improve the iLotto platform's performance, reliability, and user experience.
• Marketing Communications: To send you promotional offers, bonus notifications, and platform updates via email or SMS — only where you have provided explicit opt-in consent, and subject to your ability to withdraw consent at any time.
• Legal & Regulatory Compliance: To meet iLotto's obligations under applicable laws, including responding to lawful data requests from competent authorities and maintaining records as required.

6 Legal Basis for Processing

iLotto relies on the following legal bases when processing your personal data:

• Contractual Necessity: Processing of registration, KYC, payment, and gaming activity data is necessary to perform the contract between iLotto and you as a registered player, as set out in our Terms & Conditions.
• Legal Obligation: Processing of identity verification and transaction monitoring data is required to comply with applicable AML, fraud prevention, and regulatory reporting obligations.
• Legitimate Interests: Processing for fraud detection, platform security, responsible gambling monitoring, and analytics is carried out in pursuit of iLotto's legitimate interests, provided such interests are not overridden by your rights and freedoms.
• Consent: Processing for direct marketing communications is based on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

7 Data Sharing & Disclosure

iLotto does not sell, rent, or trade your personal data to third parties for their independent marketing or commercial purposes. We share personal data only in the following limited circumstances:

• Payment Service Providers: We share necessary transaction data with your chosen payment provider (e.g., Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX network banks including Maybank, CIMB, Public Bank, and Hong Leong) solely to process your deposits and withdrawals.
• KYC & AML Service Providers: We engage accredited third-party identity verification and AML screening services. These providers process your KYC documents and personal data as Data Processors acting under iLotto's instructions and are bound by data processing agreements.
• Technology & Infrastructure Providers: We use third-party cloud hosting, database, and cybersecurity providers to operate the iLotto platform. These providers have access only to the data necessary to perform their contracted services and operate under confidentiality and data security obligations.
• Game & Software Providers: Licensed game studios and software providers may receive anonymised or pseudonymised session and gaming data for game performance monitoring. No directly identifiable personal data is shared beyond what is strictly necessary.
• Law Enforcement & Regulatory Authorities: iLotto will disclose personal data to competent governmental authorities, law enforcement agencies, or regulators where required by law, court order, or to protect the safety and security of the platform and its users.
• Business Transfers: In the event of a merger, acquisition, or asset sale involving iLotto, personal data held by iLotto may be transferred to the acquiring entity, subject to equivalent data protection obligations.

8 Data Retention

iLotto retains personal data for the minimum period necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law. The following general retention periods apply:

Following expiration of the applicable retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with any identifiable individual.

9 Data Security

iLotto implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS Encryption: All data transmitted between your browser or device and the iLotto platform is encrypted using industry-standard 256-bit SSL/TLS protocols.
• Password Hashing: Account passwords are stored exclusively in irreversibly hashed form using modern cryptographic algorithms. iLotto staff cannot view your password in plain text.
• Two-Factor Authentication (2FA): iLotto offers optional 2FA for all accounts and strongly recommends its activation to protect against unauthorised login.
• Access Controls: Access to personal data within iLotto's systems is restricted to authorised personnel on a strict need-to-know basis, governed by role-based access control policies.
• Regular Security Audits: iLotto conducts regular vulnerability assessments and penetration testing on platform infrastructure to identify and remediate security weaknesses proactively.
• Data Breach Response: iLotto maintains a documented data breach response procedure. In the event of a breach that poses a material risk to your rights, iLotto will notify affected Users and relevant authorities within applicable timeframes.

10 Cookies & Tracking Technologies

iLotto uses cookies and similar tracking technologies to operate the platform, personalise your experience, maintain session continuity, and analyse platform usage. The following cookie categories are used:

• Strictly Necessary Cookies: Essential for the platform to function. These cookies enable core functionality such as login session management, security tokens, and payment process continuity. They cannot be disabled without impairing platform usability.
• Performance & Analytics Cookies: Used to collect anonymised information about how visitors interact with the iLotto platform, including page visit frequency, navigation paths, and error logs. This data is used to improve platform performance and content.
• Functional Cookies: Allow the platform to remember your preferences and settings (e.g., display language, odds format, last visited game category) to provide a more personalised experience.
• Marketing & Targeting Cookies: Used where you have provided consent to receive personalised promotional content based on your gaming interests and behaviour. These cookies may be shared with our marketing analytics partners under data processing agreements.

You may manage your cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use core platform features. Disabling analytics or marketing cookies will not affect your ability to play games or access your account.

11 Your Data Rights

Subject to applicable law, you have the following rights with respect to your personal data held by iLotto:

• Right of Access: You have the right to request a copy of the personal data iLotto holds about you, together with information about how it is used and with whom it is shared.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you. You may update basic account information directly within your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent, or where processing is unlawful. Please note that certain data must be retained for legal and regulatory compliance purposes and cannot be erased upon request.
• Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data or object to our processing.
• Right to Data Portability: Where processing is based on your consent or contractual necessity and carried out by automated means, you may request that we provide your personal data in a structured, machine-readable format for transfer to another service provider.
• Right to Object: You have the right to object to processing carried out on the basis of legitimate interests, including direct marketing. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing. Opt-out links are included in all marketing emails.

To exercise any of the above rights, please contact our Data Privacy team at the contact details provided in Section 15. We will acknowledge your request within 5 business days and respond substantively within 30 calendar days. Where requests are complex or numerous, this period may be extended to 60 days with prior notification.

12 Minors & Age Restriction

iLotto strictly prohibits access to and use of its platform by persons under the age of 21. The iLotto platform is not directed at, and does not knowingly collect personal data from, individuals under the age of 21.

iLotto implements age verification controls as part of its registration and KYC process to enforce this restriction. If iLotto becomes aware that personal data has been collected from a person under the age of 21 without verifiable parental or guardian consent, iLotto will take immediate steps to delete such data and close the relevant account.

If you have reason to believe that a minor has created an account on iLotto or is accessing the platform, please contact our support team immediately so that the appropriate action can be taken.

13 Third-Party Links & Services

The iLotto platform may contain links to or integrations with third-party services, including payment processors and game providers. iLotto is not responsible for the privacy practices or data protection standards of any third-party service, website, or application that is not operated by iLotto.

When you interact with a third-party payment service (for example, by authenticating your Touch 'n Go eWallet or Boost account within the payment flow), you are subject to that third party's privacy policy in addition to this Policy. We encourage you to review the privacy policies of all third-party services you interact with in connection with your iLotto account.

14 Policy Updates & Amendments

iLotto reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable law, regulatory requirements, or platform functionality. The updated Policy will be published on this page, and the "Last Updated" date at the top of the document will be revised accordingly.

Where changes are material — for example, where we intend to process your personal data for purposes not previously disclosed or to share it with new categories of recipients — iLotto will notify registered Users via the email address associated with their account at least 14 days prior to the changes taking effect, or provide a prominent notice on the platform.

Your continued use of the iLotto platform following publication of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with any amendment, you are entitled to close your account and request deletion of your personal data (subject to our mandatory retention obligations) before the amended Policy takes effect.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or iLotto's data processing practices, please contact our customer support and data privacy team using the details below. All privacy-related enquiries are handled with strict confidentiality.

Email: [email protected]

Live Chat: Available 24/7 directly within the iLotto platform at https://ilotto.cam. Average response time is under 3 minutes.

Data Access & Rights Requests: Please clearly state "Data Privacy Request" in your message header when submitting a request to exercise your data rights under Section 11. We will acknowledge your request within 5 business days.

For matters related to responsible gambling, self-exclusion, or deposit limits, please also refer to our Responsible Gambling page. For account rules and betting policies, please refer to our Terms & Conditions.