loto8 Privacy Policy

1. Introduction

loto8 ("loto8," "we," "us," "our") operates the online gaming platform accessible at loto8.app. We are committed to protecting the privacy and personal data of every player, visitor, and user ("you," "your") who interacts with the loto8 platform.

This Privacy Policy describes the types of personal information loto8 collects, the purposes for which we process that information, the parties with whom we may share it, and the rights you have in relation to your personal data. This policy applies to all loto8 services, including the loto8 website, mobile interface, customer support channels, and any other loto8-branded touchpoints.

This Privacy Policy should be read together with the loto8 Terms & Conditions. Capitalised terms not defined here have the meanings given to them in the loto8 Terms & Conditions.

2. Personal Data We Collect

loto8 collects the following categories of personal data:

2.1 Identity & Contact Data

• Full legal name
• Date of birth (used to verify the 21+ age requirement)
• Gender
• Nationality and country of residence
• Email address
• Mobile phone number
• Residential address (including barangay, city, province, and ZIP code)

2.2 Identity Verification (KYC) Data

• Government-issued photo ID (e.g., Philippine passport, SSS ID, PhilSys National ID, driver's licence, UMID)
• Proof of address documents
• Selfie or liveness-check image (where required for enhanced verification)
• Proof of payment method ownership

2.3 Financial Data

• GCash or PayMaya / Maya account reference (masked)
• Bank account details (masked, for withdrawal processing)
• Debit card details (masked)
• Transaction history: deposits, withdrawals, bet amounts, winnings, and bonus activity

2.4 Gaming & Behavioural Data

• Game session logs (game type, duration, stakes, outcomes)
• Betting history across all loto8 game categories
• Responsible gaming tool usage (deposit limits, self-exclusion requests, cooling-off periods)
• Bonus and promotion redemption history

2.5 Technical & Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser version
• Unique device identifiers
• Login timestamps and session duration
• Referring URL and navigation path within the loto8 platform

2.6 Communications Data

• Customer support chat transcripts and email correspondence
• Survey responses and feedback submissions
• Marketing preference settings

3. How We Collect Your Data

loto8 collects personal data through the following means:

• Direct collection: Information you provide when registering a loto8 account, completing KYC verification, making a deposit or withdrawal, contacting customer support, or participating in a promotion.
• Automated collection: Technical and behavioural data collected automatically when you access and use the loto8 platform, including through cookies, web beacons, and server logs.
• Third-party sources: Identity verification data from KYC service providers; fraud and risk signals from payment processors; geolocation data from IP intelligence services.

4. How We Use Your Personal Data

loto8 uses your personal data for the following purposes:

loto8 does not use your personal data for automated decision-making that produces legal or similarly significant effects without human review, except where required by law or regulation.

5. Legal Basis for Processing

loto8 processes your personal data on the following legal bases under the Philippine Data Privacy Act of 2012 and its Implementing Rules and Regulations:

• Contractual necessity: Processing required to perform the loto8 Terms & Conditions, including account management, payment processing, and game provision.
• Legal obligation: Processing required to comply with applicable laws and regulations, including PAGCOR licensing requirements, AML obligations, and tax reporting.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and analytics, where these interests are not overridden by your rights.
• Consent: Processing for marketing communications and non-essential cookies, where you have given explicit consent. You may withdraw consent at any time.

6. Data Sharing & Disclosure

loto8 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

• KYC and identity verification providers: To verify your identity and age in compliance with regulatory requirements.
• Payment processors and e-wallet providers: Including GCash, PayMaya / Maya, and partner banks, to process deposits and withdrawals.
• Game content providers: Third-party game studios whose games are hosted on the loto8 platform may receive session data necessary to operate their games.
• Fraud prevention and AML service providers: To detect and prevent fraudulent activity and money laundering.
• Regulatory and law enforcement authorities: Including PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine authorities, where required by law or regulatory directive.
• IT and cloud infrastructure providers: Who host and maintain the loto8 platform under strict data processing agreements.
• Professional advisers: Including lawyers, auditors, and accountants, under obligations of confidentiality.

All third parties with whom loto8 shares personal data are required to process that data in accordance with applicable data protection law and loto8's data processing standards.

7. Cookies & Tracking Technologies

loto8 uses cookies and similar tracking technologies to operate and improve the platform. The categories of cookies used by loto8 are:

• Strictly necessary cookies: Required for the loto8 platform to function. These cannot be disabled. They include session authentication cookies and security tokens.
• Functional cookies: Remember your preferences (e.g., language, display settings) to personalise your loto8 experience.
• Analytics cookies: Collect aggregated, anonymised data about how players use the loto8 platform, helping us identify areas for improvement.
• Marketing cookies: Used only with your consent to deliver relevant promotional content about loto8 games and offers.

You can manage your cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the loto8 platform.

8. Data Retention

loto8 retains your personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, accounting, and reporting requirements. The following general retention periods apply:

• Account and KYC data: Retained for a minimum of five (5) years after account closure, in accordance with PAGCOR and AMLC requirements.
• Transaction and financial data: Retained for a minimum of five (5) years from the date of the transaction.
• Gaming session data: Retained for a minimum of three (3) years.
• Customer support communications: Retained for two (2) years from the date of the last interaction.
• Marketing consent records: Retained until consent is withdrawn, plus one (1) year thereafter.

When personal data is no longer required, loto8 will securely delete or anonymise it in accordance with our data disposal procedures.

9. Data Security

loto8 implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• TLS/SSL encryption for all data transmitted between your device and the loto8 platform
• Encryption of sensitive data at rest, including financial and KYC data
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis
• Regular security assessments and penetration testing of the loto8 platform
• Multi-factor authentication for administrative access to loto8 systems
• Incident response procedures for detecting, reporting, and managing personal data breaches

While loto8 takes all reasonable steps to protect your personal data, no online platform can guarantee absolute security. You are responsible for keeping your loto8 login credentials confidential and for notifying us immediately if you suspect any unauthorised access to your account.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, loto8 will notify the National Privacy Commission (NPC) and affected players in accordance with the requirements of the Data Privacy Act of 2012 and its Implementing Rules and Regulations.

10. Your Data Privacy Rights

Under the Philippine Data Privacy Act of 2012, you have the following rights in relation to your personal data held by loto8:

• Right to be informed: You have the right to know what personal data loto8 holds about you and how it is being processed.
• Right of access: You may request a copy of the personal data loto8 holds about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to loto8's legal retention obligations.
• Right to object: You may object to the processing of your personal data for direct marketing purposes at any time.
• Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe loto8 has not handled your personal data in accordance with applicable law.

To exercise any of these rights, please contact the loto8 Data Protection Officer using the contact details in Section 15. loto8 will respond to all verified data subject requests within thirty (30) days, in accordance with the Data Privacy Act of 2012.

11. Children & Minors

The loto8 platform is strictly intended for persons aged 21 years and above. loto8 does not knowingly collect personal data from persons under the age of 21. If loto8 becomes aware that personal data has been collected from a person who does not meet the minimum age requirement, that account will be suspended immediately and the personal data will be deleted in accordance with applicable regulations, subject to any mandatory retention obligations.

If you believe that a minor has registered a loto8 account, please contact our support team immediately so that we can investigate and take appropriate action.

12. International Data Transfers

loto8 primarily processes and stores personal data within the Philippines. Where it is necessary to transfer personal data to service providers or infrastructure located outside the Philippines — for example, cloud hosting or KYC verification services — loto8 ensures that such transfers are carried out in accordance with the Data Privacy Act of 2012, including by implementing appropriate safeguards such as data processing agreements that require the recipient to maintain data protection standards equivalent to those required under Philippine law.

13. Third-Party Links

The loto8 platform may contain references to third-party services such as payment providers. loto8 is not responsible for the privacy practices of third-party websites or services. We encourage you to review the privacy policies of any third-party service you access in connection with your use of loto8.

14. Updates to This Privacy Policy

loto8 may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, loto8 will notify registered players via email or an in-platform notification prior to the changes taking effect. The updated Privacy Policy will be published on this page with a revised effective date. Your continued use of the loto8 platform after the effective date of any update constitutes your acceptance of the revised Privacy Policy.

15. Contact & Data Protection Officer

loto8 has appointed a Data Protection Officer (DPO) in accordance with the requirements of the Data Privacy Act of 2012. If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by loto8, please contact our DPO:

Data Protection Officer – loto8
Email: [email protected] (plain text — not a clickable link)
General support: [email protected] (plain text — not a clickable link)

loto8 will acknowledge all privacy-related enquiries within five (5) business days and will endeavour to resolve them within thirty (30) days. If you are not satisfied with loto8's response, you have the right to escalate your complaint to the National Privacy Commission of the Philippines.