lotto8 Privacy Policy

1. Introduction

1.1 This Privacy Policy ("Policy") applies to all personal data collected by lotto8 ("lotto8," "we," "us," "our") through the lotto8 website at https://lotto8.app, the lotto8 mobile application, and all related services (collectively, the "Platform").

1.2 lotto8 is committed to handling your personal data responsibly, transparently, and in full compliance with the Data Privacy Act of 2012 of the Philippines (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC").

1.3 This Policy should be read together with the lotto8 Terms & Conditions, which govern your use of the Platform. Terms not defined in this Policy have the meanings given to them in the Terms & Conditions.

2. Data Controller

2.1 For the purposes of the Data Privacy Act of 2012, lotto8 is the personal information controller ("PIC") in respect of the personal data you provide when using the Platform.

2.2 lotto8 has appointed a Data Protection Officer ("DPO") who is responsible for overseeing compliance with this Policy and applicable data protection laws. Contact details for the DPO are provided in Section 14 of this Policy.

3. Personal Data We Collect

3.1 lotto8 collects personal data that you provide directly, data generated through your use of the Platform, and data received from third parties. The categories of personal data we collect include:

3.1.1 Registration & Identity Data

• Full legal name;
• Date of birth (to verify you are 21 years of age or older);
• Gender;
• Nationality and country of residence;
• Government-issued ID number (e.g., Philippine passport, SSS ID, driver's license);
• Email address and mobile number.

3.1.2 Contact & Address Data

• Residential address (including barangay, city/municipality, province);
• Billing address (if different from residential address).

3.1.3 Financial & Transaction Data

• GCash account number or PayMaya account details;
• Bank account details (BPI, BDO, Metrobank, UnionBank, or other Philippine banks);
• Credit/debit card details (processed securely via PCI-DSS compliant payment processors);
• Deposit and withdrawal history;
• Wagering and gaming transaction records.

3.1.4 Technical & Usage Data

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Session duration, pages visited, and features used;
• Login timestamps and access logs.

3.1.5 Communications Data

• Records of communications with lotto8 customer support (live chat transcripts, email correspondence);
• Survey responses and feedback submitted to lotto8.

4. How We Use Your Personal Data

4.1 lotto8 uses your personal data for the following purposes:

4.2 lotto8 will not use your personal data for any purpose incompatible with the purposes listed above without first obtaining your consent or as otherwise permitted by applicable law.

5. Legal Basis for Processing

5.1 lotto8 processes your personal data on the following legal bases under the Data Privacy Act of 2012:

• Contractual Necessity: Processing is necessary to perform the contract between you and lotto8 (i.e., to provide the gaming services you have registered for);
• Legal Obligation: Processing is required to comply with applicable Philippine laws, including the Anti-Money Laundering Act (RA 9160), PAGCOR regulations, and the DPA itself;
• Legitimate Interests: Processing is necessary for lotto8's legitimate interests, including fraud prevention, platform security, and responsible gaming monitoring, provided these interests are not overridden by your rights;
• Consent: For marketing communications and certain optional data processing activities, lotto8 relies on your freely given, specific, informed, and unambiguous consent.

6. Data Sharing & Disclosure

6.1 lotto8 does not sell, rent, or trade your personal data to third-party marketers under any circumstances.

6.2 lotto8 may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, and card payment processors, for the purpose of processing deposits and withdrawals;
• KYC & Identity Verification Providers: Third-party identity verification services used to fulfill KYC obligations;
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine government agencies , as required by law or regulatory mandate;
• IT & Hosting Providers: Cloud infrastructure and hosting partners who process data on lotto8's behalf under strict data processing agreements;
• Fraud Prevention Services: Third-party fraud detection and cybersecurity providers used to protect the Platform and its users;
• Professional Advisers: Lawyers, auditors, and accountants where necessary for legal or compliance purposes.

6.3 All third parties with whom lotto8 shares personal data are required to handle that data in accordance with the DPA and lotto8's data protection standards. lotto8 enters into data sharing agreements or data processing agreements with such parties as required by law.

6.4 lotto8 may disclose your personal data if required to do so by law, court order, or at the request of a competent Philippine government authority, or where lotto8 believes disclosure is necessary to protect the rights, property, or safety of lotto8, its players, or the public.

7. Cookies & Tracking Technologies

7.1 lotto8 uses cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device when you visit the lotto8 website.

7.2 lotto8 uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the Platform to function. These cannot be disabled. They include session management, login authentication, and security cookies;
• Performance & Analytics Cookies: Used to understand how players interact with the Platform, identify errors, and improve user experience;
• Functional Cookies: Used to remember your preferences, such as language settings and responsible gaming limits;
• Marketing Cookies: Used to deliver relevant promotions and measure the effectiveness of lotto8 marketing campaigns. These are only set with your consent.

7.3 You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the lotto8 Platform. For strictly necessary cookies, no opt-out is available as they are required for the Platform to operate.

8. Data Retention

8.1 lotto8 retains your personal data for as long as your account is active and for a period thereafter as required by applicable Philippine law and regulatory obligations.

8.2 Specifically:

• Account and identity data is retained for a minimum of 5 years after account closure, in compliance with PAGCOR licensing requirements and the Anti-Money Laundering Act;
• Financial transaction records are retained for a minimum of 5 years from the date of the transaction, as required by the AMLA;
• Customer support communications are retained for 3 years from the date of the interaction;
• Marketing consent records are retained for the duration of your account and for 2 years after opt-out.

8.3 When personal data is no longer required for the purposes for which it was collected and the applicable retention period has expired, lotto8 will securely delete or anonymize that data.

9. Data Security

9.1 lotto8 implements appropriate technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data in transit;
• AES-256 encryption for sensitive data at rest;
• Multi-factor authentication for account access;
• Regular penetration testing and security audits;
• Strict access controls limiting data access to authorized personnel only;
• PCI-DSS compliant payment processing for all card transactions.

9.2 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, lotto8 will notify the National Privacy Commission and affected data subjects in accordance with the DPA's breach notification requirements.

10. Your Rights as a Data Subject

10.1 Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by lotto8:

• Right to be Informed: The right to be informed of how your personal data is being collected and processed — which this Policy fulfills;
• Right of Access: The right to request a copy of the personal data lotto8 holds about you;
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to Erasure: The right to request deletion of your personal data, subject to lotto8's legal retention obligations;
• Right to Object: The right to object to the processing of your personal data, including for direct marketing purposes;
• Right to Data Portability: The right to receive your personal data in a structured, commonly used format;
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data rights have been violated.

10.2 To exercise any of these rights, please contact lotto8's Data Protection Officer using the contact details in Section 14. lotto8 will respond to your request within 15 business days, as required by the DPA's Implementing Rules.

10.3 lotto8 may need to verify your identity before processing a data subject rights request to ensure the security of your personal data.

11. Children's Privacy

11.1 If you are a parent or guardian and believe that a minor under your care has provided personal data to lotto8, please contact our support team immediately at the contact details provided in Section 14. lotto8 will take prompt action to delete the data and close the account.

12. Cross-Border Data Transfers

12.1 lotto8 primarily stores and processes personal data within the Philippines. In certain circumstances, personal data may be transferred to or processed by service providers located outside the Philippines (for example, cloud infrastructure providers or international payment processors).

12.2 Where personal data is transferred outside the Philippines, lotto8 ensures that appropriate safeguards are in place to protect your data, including contractual clauses that require the recipient to apply data protection standards equivalent to those required under the DPA.

12.3 By using the lotto8 Platform, you consent to the transfer of your personal data outside the Philippines where necessary for the provision of lotto8's services, subject to the safeguards described above.

13. Updates to This Privacy Policy

13.1 lotto8 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we offer. When material changes are made, lotto8 will notify registered players via email or an in-platform notification.

13.2 The "Last Updated" date at the top of this Policy indicates when the most recent changes were made. Your continued use of the lotto8 Platform after the effective date of any update constitutes your acceptance of the revised Policy.

13.3 We encourage you to review this Privacy Policy periodically to stay informed about how lotto8 protects your personal data.

14. Contact & Data Protection Officer

14.1 If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact lotto8's Data Protection Officer:

14.2 If you are not satisfied with lotto8's response to your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines: