Privacy Policy
lott9 Personal Data Protection Statement

This Privacy Policy ("Policy") is issued by lott9 ("lott9", "we", "us", "our"), the operator of the online gambling platform accessible at https://lott9.cam. This Policy sets out our practices with respect to the collection, use, storage, disclosure, and protection of personal data belonging to our registered users ("Players", "Users", "you") and visitors to our platform.

lott9 is committed to protecting the privacy and personal data of all individuals who interact with our platform, with particular attention to the expectations and legal framework applicable to our Malaysian player base. We handle your data with care, transparency, and in accordance with applicable data protection principles.

This Policy should be read in conjunction with our Terms & Conditions and our Responsible Gambling Policy, all of which together form the full framework governing your relationship with lott9.

For the purposes of this Privacy Policy, the following terms shall carry the meanings set out below:

lott9 collects only the personal data that is necessary for the operation of our platform, the delivery of our services, regulatory compliance, and the protection of our players and business. The categories of personal data we may collect include:

lott9 collects personal data through the following mechanisms:

• Direct Submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in promotions.
• Automated Technical Collection: Technical data collected automatically when you access the platform, including IP addresses, device fingerprints, browser session data, and cookies. See Section 9 (Cookies & Tracking) for further detail.
• Payment Processor Data: Transaction references and confirmation data shared by Malaysian payment processors (including DuitNow, FPX operators such as Maybank and CIMB, and e-wallet providers such as Touch 'n Go eWallet and Boost) when processing your deposits and withdrawals.
• KYC Service Providers: Identity verification data returned by third-party KYC service providers engaged by lott9 to verify the identity and age of Players. These providers process document images and biometric data solely for verification purposes.
• Third-Party Analytics: Anonymised or pseudonymised data from analytics platforms used to understand platform usage patterns, improve user experience, and detect fraud.

lott9 processes your personal data for the following specific and legitimate purposes:

• Account Management: Creating, maintaining, and administering your player account, including processing deposits, withdrawals, bonus allocations, and VIP tier management.
• Identity & Age Verification: Conducting KYC checks to confirm that all players are 21 years of age or older, as required by our age restriction policy, and to verify identity in accordance with AML obligations.
• Payment Processing: Facilitating deposits and withdrawals via your chosen payment method, including DuitNow, FPX, Touch 'n Go eWallet, Boost, GrabPay, and cryptocurrency channels.
• Fraud Prevention & Security: Detecting, investigating, and preventing fraudulent transactions, account compromise, money laundering, and other prohibited activities.
• Responsible Gambling: Monitoring player behaviour for indicators of gambling harm; enforcing self-exclusion requests; applying and tracking voluntary deposit limits and session restrictions.
• Customer Support: Responding to support enquiries, resolving disputes, and maintaining communication records for quality assurance purposes.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have consented to receiving such communications. You may withdraw this consent at any time through your account settings.
• Legal & Regulatory Compliance: Meeting obligations under applicable anti-money laundering (AML), counter-terrorist financing (CTF), and other regulatory requirements.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the performance, features, and user experience of the lott9 platform.

lott9 processes personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our contract with you — account creation, payment processing, game participation, and support services.
• Legal Obligation: Processing required to comply with applicable legal requirements, including KYC verification, AML monitoring, and regulatory reporting obligations.
• Legitimate Interests: Processing necessary for the pursuit of lott9's legitimate business interests, including fraud prevention, platform security, and business analytics — where such interests are not overridden by your privacy rights.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — principally for direct marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

lott9 does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data processing agreements:

• Payment Processors: Malaysian payment service providers (including DuitNow operators, FPX-connected banks, Touch 'n Go eWallet, Boost, and GrabPay) and cryptocurrency network facilitators, solely for the purpose of processing your deposits and withdrawals.
• KYC & Identity Verification Providers: Third-party identity verification services engaged to conduct document authentication and biometric verification for KYC compliance.
• Fraud Prevention Services: Specialised fraud detection and AML screening services that help us identify and prevent fraudulent or illicit activity on the platform.
• IT Infrastructure Providers: Cloud hosting, database, and cybersecurity service providers that support the technical operation of the lott9 platform, subject to strict confidentiality obligations.
• Legal & Regulatory Authorities: Where required by applicable law, court order, or regulatory authority, lott9 may disclose personal data to competent government bodies, law enforcement agencies, or regulatory authorities.
• Professional Advisers: Legal, accounting, or professional advisory firms engaged by lott9, subject to professional secrecy obligations.

lott9 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including for the satisfaction of legal, regulatory, accounting, or reporting requirements. The following retention guidelines apply:

• Active Account Data: Retained for the duration of your account's active status and for a period of up to 5 years following account closure, to satisfy AML and regulatory record-keeping obligations.
• KYC Documentation: Retained for a minimum of 5 years following the end of the business relationship, in accordance with applicable AML record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of 5 years following the relevant transaction, for audit, AML, and dispute resolution purposes.
• Communication Records: Support interactions and email correspondence retained for up to 3 years for dispute resolution and quality assurance purposes.
• Technical & Log Data: Server logs and session data retained for up to 12 months for security and fraud analysis purposes.
• Self-Exclusion Records: Records of self-exclusion requests are retained indefinitely to prevent re-registration by self-excluded individuals.

Upon expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised.

lott9 uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small text files stored on your device when you visit our website. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the operation of the platform. These include session authentication cookies, security tokens, and load-balancing cookies. These cookies cannot be disabled without disrupting platform functionality.
• Functional Cookies: Remember your preferences such as language settings, preferred payment method, and account display options. Disabling these may affect platform personalisation.
• Analytics Cookies: Collect anonymised data about how users interact with the platform, including pages visited, session duration, and navigation paths. This data helps us improve the platform.
• Security & Fraud Detection Cookies: Monitor for unusual session activity, multiple account detection, and automated bot traffic. These are essential for platform integrity.

lott9 implements a comprehensive range of technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our security framework includes:

• 256-bit SSL/TLS Encryption: All data transmitted between your device and the lott9 platform is encrypted using industry-standard TLS protocols.
• Encrypted Data Storage: Sensitive personal data, including financial records and KYC documentation, is stored in encrypted form at rest.
• Two-Factor Authentication (2FA): Available to all registered Players for enhanced account security.
• Access Controls: Strict role-based access controls limit staff access to personal data on a need-to-know basis. All staff with data access are subject to confidentiality obligations.
• Regular Security Audits: Our platform undergoes regular penetration testing and security audits conducted by qualified cybersecurity professionals.
• Breach Response Protocol: In the event of a personal data breach that poses a risk to your rights, lott9 will notify affected players without undue delay and take all necessary remedial steps.

Whilst lott9 employs industry-standard security measures, no electronic transmission over the internet can be guaranteed to be 100% secure. You are responsible for maintaining the security of your own account credentials. Contact support immediately if you suspect your account has been compromised.

As a Data Subject, you hold the following rights in respect of your personal data processed by lott9. To exercise any of these rights, please contact us via the channels set out in Section 15:

• Right of Access: You have the right to request confirmation of whether lott9 holds personal data about you, and to receive a copy of that data in a structured, commonly used format.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data held about you. Minor corrections (e.g., email address, phone number) can be made directly through your account settings.
• Right to Erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to lott9's legal retention obligations. Note that regulatory requirements may prevent full erasure of certain data categories.
• Right to Restrict Processing: You may request that we restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is contested.
• Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may request a copy of your personal data in a portable, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests, including direct marketing. Where you object to marketing, we will cease processing for that purpose immediately.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

We will respond to valid data subject requests within 30 days of receipt. Complex or numerous requests may require additional time, in which case we will notify you of the extended timeline and reason.

The lott9 platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect personal data from individuals under 21 years of age.

As part of our KYC procedures, all registered players are required to provide proof of age. Accounts found to belong to individuals under 21 will be immediately suspended, all associated data will be retained only as required by applicable law, and any real-money balance will be handled in accordance with our Terms & Conditions and applicable regulations.

The lott9 platform integrates with several third-party services to deliver its full functionality. Each of these third parties is subject to their own privacy policies and data processing terms. lott9 exercises due diligence in selecting third-party partners and requires that all partners processing personal data on our behalf maintain appropriate data protection standards.

Third-party integrations relevant to Malaysian players include:

• Malaysian E-Wallet Providers (Touch 'n Go eWallet, Boost, GrabPay): Process payment data for deposit and withdrawal transactions. Their respective privacy policies govern their handling of your financial data.
• FPX-Connected Banks (Maybank, CIMB, Public Bank, Hong Leong): Handle online banking transfers. Each bank's privacy framework governs data shared through their banking interfaces.
• Cryptocurrency Networks: Blockchain-based transactions are inherently public by design; transaction hashes are visible on the respective blockchain ledgers.
• KYC Verification Partners: Third-party identity verification services process document images and facial biometric data solely for KYC purposes under strict contractual data protection terms.

lott9 is not responsible for the privacy practices of third-party services. We recommend reviewing the privacy policies of any third-party providers you interact with directly.

lott9 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data practices, applicable legal requirements, or the evolution of the lott9 platform. All updates will be published on this page with a revised "Last Updated" date.

Material changes — those that significantly affect how we collect, use, or share your personal data — will be communicated to registered players via email notification to the address held on their account, providing a minimum of 14 days' notice before the changes take effect.

Your continued use of the lott9 platform following notification of amendments constitutes your acceptance of the revised Policy. We recommend bookmarking and reviewing this page periodically.

If you have any questions, concerns, or requests relating to this Privacy Policy or lott9's data processing practices, please contact us through the following channels. All privacy-related enquiries are handled with priority and in strict confidence.

• Email: [email protected] — plain text only, not a clickable link. Average response: within 2 hours.
• Live Chat: Available 24 hours a day, 7 days a week, in English, Bahasa Melayu, and Mandarin. For urgent privacy or security concerns, live chat provides the fastest response.
• Data Subject Rights Requests: To exercise any of your rights described in Section 11, please submit your request in writing via the email address above, stating your full name, account username, and the specific right you wish to exercise. We will acknowledge your request within 5 business days.