lotto4 Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how lotto4 ("we", "our", or "platform") collects, processes, uses, stores, discloses, and protects information about individuals ("you" or "player") who access or interact with the lotto4 website, account services, sportsbook, live casino, or related features.

By registering a lotto4 account, completing identity verification, making a deposit, placing a wager, or otherwise interacting with our platform, you acknowledge that you have read this Policy and understand how lotto4 uses your personal data. If you disagree with the practices described, you should refrain from using the platform.

This Policy should be read alongside the Terms & Conditions, which govern the overall relationship between lotto4 and registered users. Malaysian players should also note that data-related laws may apply independently of this Policy. This document addresses lotto4's own practices and does not constitute legal advice.

2. Definitions

• Personal Data: any information that identifies or could reasonably be used to identify a living individual, including name, national identity number, email address, mobile number, payment account details, and device identifiers.
• Processing: any operation performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, erasure, or destruction.
• Controller: lotto4, the entity that determines the purposes and means of processing personal data received from platform users.
• Third-Party Service Provider: a company engaged by lotto4 to perform specific processing functions, such as payment gateway operation, identity verification, fraud monitoring, or customer support tooling.
• Cookies: small text files stored on a user's device by a web browser to remember preferences, session state, or browsing behaviour related to lotto4.
• KYC: Know Your Customer — the identity and age verification process required to confirm that a registered account holder meets lotto4's eligibility criteria.

3. Personal Data We Collect

lotto4 collects data in three ways: directly from you, automatically through platform use, and from verification service providers. The categories listed below reflect information that may be relevant at different stages of using the platform.

lotto4 does not knowingly collect sensitive categories of personal data — such as health, political opinion, or biometric identifiers — beyond what is strictly required for legal identity verification.

4. Purposes and Lawful Basis for Processing

lotto4 processes personal data only when a legitimate basis applies. The following table maps each purpose to the corresponding basis.

Where lotto4 relies on legitimate interest, that interest has been weighed against the rights of the individual. Players may object to legitimate-interest processing in specific circumstances; see Section 9 (Your Rights) for further details.

5. Disclosure and Data Sharing

lotto4 does not sell personal data to third parties. Disclosure takes place only in the following circumstances:

5.1 Service Providers

Payment processors, identity verification platforms, anti-fraud engines, cloud hosting providers, and customer support software companies may receive limited personal data necessary to perform their contracted function. Each is subject to contractual obligations that restrict further processing beyond the agreed purpose.

5.2 Payment Channels

When you initiate a transaction using Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, or Hong Leong Connect, lotto4 transmits the data required to execute or validate that transaction. Each provider's own terms and privacy notice govern their handling of such data.

5.3 Legal and Regulatory Obligations

lotto4 may be required to disclose information to a competent authority, court, licensing body, or financial intelligence unit when compelled by a lawful order or when disclosure is necessary to prevent or report a serious crime or regulatory breach.

5.4 Business Transfers

In the event of a merger, acquisition, or substantial sale of platform assets, registered user data may form part of the transferred information. Players will be notified in advance through their registered contact details where materially practicable.

6. Cookies and Tracking Technologies

The lotto4 platform uses cookies and similar technologies to maintain secure sessions, remember player preferences, detect fraudulent login attempts, and measure aggregate usage patterns. The principal categories in use are described below.

• Essential cookies: Required for the platform to function. These maintain your login session, apply security tokens, and preserve language or display preferences. They cannot be disabled without affecting core functionality.
• Analytics cookies: Used in aggregate, non-identifiable form to understand which sections of the platform are accessed most, how long sessions last, and where errors occur. This data assists lotto4 in improving the player experience.
• Preference cookies: Store voluntary choices you make on the platform, such as responsible gambling limit preferences or notification settings.

Most browser settings allow you to view, block, or delete cookies. Blocking essential cookies will impair your ability to log in and use lotto4 features. Adjusting cookie preferences on your mobile device — whether you access lotto4 from Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, or elsewhere — does not delete previously collected session data.

7. Data Retention

lotto4 retains personal data for as long as required to fulfil the purpose for which it was collected, or as required by applicable legal, regulatory, or financial record-keeping obligations. The following indicative periods apply:

• Account and identity records: Retained for the duration of the active account relationship and for a defined period after closure, consistent with anti-money laundering retention requirements.
• Financial and transaction records: Payment instructions, MYR deposit and withdrawal records, and bet histories are retained for the period required by applicable financial-record legislation.
• Support communications: Support chat transcripts and email records are generally retained for a period that allows complaint review, regulatory audit, or dispute resolution.
• Marketing data: Held only while consent remains active. Following withdrawal of consent, marketing-specific data is removed from active use promptly, subject to any residual legal record.
• Technical and device data: Aggregated technical logs are retained for security monitoring and then deleted or anonymised on a rolling schedule.

When retention is no longer justified, data is securely deleted or anonymised so that it can no longer be associated with an identifiable individual.

8. Data Security

lotto4 applies technical and organisational measures to protect personal data against unauthorised access, disclosure, loss, alteration, or destruction. These include:

• Transport Layer Security (TLS) encryption for data transmitted between a player's device and lotto4 servers.
• At-rest encryption for databases containing sensitive identity and financial records.
• Access controls limiting internal staff access to personal data based on role and documented need.
• Regular security assessments and penetration reviews for critical infrastructure components.
• Fraud-detection monitoring for unusual transaction and login activity.

No internet-connected system is completely immune to security incidents. If lotto4 becomes aware of a breach that is likely to cause material risk to registered players, we will take appropriate containment steps and notify affected individuals as required by applicable obligations.

Players are responsible for maintaining the confidentiality of their login credentials. If you believe your lotto4 account has been accessed without your authorisation, contact support immediately. Do not share your password, OTP, or two-factor authentication code with any person.

9. Your Rights

Registered lotto4 players may exercise the following rights in relation to their personal data. Requests are reviewed in accordance with applicable data protection law. lotto4 may ask you to verify your identity before fulfilling a request.

• Right of access: You may request a summary of the personal data lotto4 holds about you and the purposes for which it is used.
• Right to rectification: If personal data held is inaccurate or incomplete, you may ask for correction. Contact details, bank account, and e-wallet information can often be updated directly in account settings after verification.
• Right to erasure: In certain circumstances — for example, where data is no longer necessary or consent has been withdrawn — you may request deletion. This right does not apply where legal obligations require continued retention.
• Right to restrict processing: You may request that lotto4 temporarily suspend the processing of your data while a dispute about accuracy or legitimate interest is resolved.
• Right to object: You may object to processing carried out under a legitimate interest basis where your individual circumstances outweigh the interest. You may opt out of direct marketing at any time.
• Right to withdraw consent: Where lotto4 has relied on consent for specific processing — such as marketing communications — you may withdraw that consent without affecting previously completed transactions.

To exercise any right, contact lotto4 using the details in Section 12. We will respond within a reasonable period, consistent with applicable law. Requests that are manifestly unfounded, excessive, or repetitive may be declined with an explanation.

10. International Data Transfers

lotto4 may process or store personal data on servers located outside Malaysia. Where data is transferred internationally, lotto4 applies contractual safeguards or relies on the equivalent measures used by third-party service providers to protect data during transmission and storage.

Payment transaction data transmitted through Malaysian payment networks — including DuitNow, FPX, Maybank2u, CIMB Clicks, Public Bank, Hong Leong Connect, Touch 'n Go eWallet, and Boost — is governed by the terms of each respective payment network and their own data handling standards.

11. Minors and Age Verification

lotto4 does not knowingly collect or process personal data from persons under the age of 21. Account registration requires confirmation of eligibility, and identity verification procedures are used to substantiate age. If lotto4 identifies that data has been provided by an ineligible individual, the associated account will be closed and the data will be deleted or flagged as required by applicable obligations.

12. Policy Updates

lotto4 may update this Privacy Policy to reflect changes in platform features, data processing practices, payment service integrations, legal requirements, or security measures. The current version will always be available at lotto4.cam/privacy-policy with its effective date clearly stated.

Where a revision materially affects how existing player data is used, lotto4 will provide notice through the registered account email or a prominent in-platform notification before the change takes effect. Continued use of lotto4 after an updated policy takes effect constitutes acceptance of the revised terms.