Privacy Policy
lotto9 is committed to protecting the privacy and personal data of every Filipino player on our platform. This Privacy Policy explains what information we collect, how we use it, and the rights you hold under Philippine law.
Our Privacy Principles
These six principles guide how lotto9 handles your personal data — from the moment you register to every transaction you make on our platform.
Lawful Processing Only
lotto9 processes your personal data only on lawful bases — your consent, contractual necessity, legal obligations under PAGCOR regulations, and our legitimate interests in operating a secure gaming platform.
Purpose Limitation
We collect your data only for specific, explicit, and legitimate purposes. Your personal information will never be used for purposes incompatible with those disclosed in this Privacy Policy without your prior consent.
Data Minimisation
lotto9 collects only the personal data that is strictly necessary for delivering our services, meeting regulatory requirements, and maintaining platform security. We do not collect data we do not need.
Accuracy
We take reasonable steps to ensure that the personal data we hold about you is accurate and up to date. You can update your Account information at any time through the lotto9 platform settings or by contacting support.
Security by Design
lotto9 implements industry-standard technical and organisational security measures — including SSL encryption, two-factor authentication, and access controls — to protect your data from unauthorised access or disclosure.
Your Rights Are Central
Under the Philippine Data Privacy Act of 2012, you hold clearly defined rights over your personal data. lotto9 is committed to honouring those rights promptly and transparently whenever you exercise them.
Please Read Carefully: This Privacy Policy governs the collection, use, storage, and disclosure of personal data by lotto9 in connection with your use of the lotto9 platform at https://lotto9.vu. By registering an account or using our services, you acknowledge that you have read and understood this policy.
1 Introduction & Scope
lotto9 values the privacy of every player on our platform. This Privacy Policy has been prepared in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, as enforced by the National Privacy Commission (NPC) of the Philippines. It applies to all personal data collected by lotto9 through the lotto9 website at https://lotto9.vu, our mobile-optimised interface, customer support channels, and any other point of interaction between you and lotto9.
This Policy applies to all registered players, prospective registrants, visitors to our website, and any individual whose personal data we process in connection with the lotto9 platform. It covers data collected from players across the Philippines, including those in Manila, Cebu, Davao, Quezon City, Makati, and all other locations where lotto9 services are accessible.
This Privacy Policy should be read together with our Terms & Conditions and our Responsible Gaming Policy, both of which are incorporated herein by reference. In the event of any conflict between this Privacy Policy and our Terms & Conditions with respect to the treatment of personal data, this Privacy Policy shall prevail.
2 Data Controller
For the purposes of the Data Privacy Act of 2012, lotto9 acts as the Personal Information Controller (PIC) in respect of the personal data it collects and processes through the lotto9 platform. lotto9 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing is conducted lawfully, fairly, and transparently.
Where lotto9 engages third-party service providers to process personal data on its behalf — such as payment processors, identity verification providers, or cloud infrastructure providers — those third parties act as Personal Information Processors (PIPs) and are contractually bound to process your data only on lotto9's documented instructions and in accordance with applicable data protection law.
lotto9 has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Privacy Policy and with the Data Privacy Act. Contact details for the DPO are provided in Section 15 of this Policy.
3 Data We Collect
lotto9 collects the following categories of personal data in connection with the operation of the platform:
| Category | Examples | Purpose |
|---|---|---|
| Identity Data | Full legal name, date of birth, government-issued ID number, selfie/photo for KYC | Account registration, age verification (21+), KYC compliance |
| Contact Data | Email address, mobile number, residential address | Account management, notifications, customer support |
| Financial Data | GCash number, Maya account, bank account details (BPI, BDO, Metrobank), transaction history | Processing deposits and withdrawals, AML compliance |
| Gaming Data | Wager history, game sessions, win/loss records, bonus usage, responsible gaming settings | Service delivery, responsible gaming monitoring, dispute resolution |
| Technical Data | IP address, device type, browser type, operating system, session duration, login timestamps | Security monitoring, fraud detection, platform optimisation |
| Communications Data | Customer support chat logs, emails, feedback submissions | Support delivery, quality assurance, dispute resolution |
| Marketing Preferences | Promotional opt-in/opt-out status, communication channel preferences | Delivering relevant offers and promotions with your consent |
lotto9 does not collect or store full credit or debit card numbers. All payment card data, where applicable, is handled exclusively by our PCI-DSS compliant payment processing partners and is never transmitted to or stored on lotto9's servers.
4 How We Collect Your Data
lotto9 collects personal data through the following channels and methods:
4.1 Directly from You
The majority of personal data lotto9 holds is provided directly by you in the course of:
- Completing the account registration form on lotto9;
- Submitting KYC verification documents (e.g., government-issued ID, proof of address);
- Making deposit or withdrawal requests and providing payment account details;
- Contacting lotto9 customer support via chat, email, or any other support channel;
- Completing surveys, promotions, or feedback forms on the platform;
- Setting responsible gaming preferences such as deposit limits or self-exclusion requests.
4.2 Automatically from Your Device
When you access and use the lotto9 platform, certain technical data is collected automatically through cookies, log files, and similar tracking technologies, including:
- Your IP address and approximate geographic location;
- Device identifiers, browser type and version, and operating system;
- Pages visited on lotto9, time spent on each page, and navigation paths;
- Session start and end times, login frequency, and platform feature usage.
4.3 From Third Parties
lotto9 may receive personal data about you from third-party sources, including:
- Identity Verification Providers — results of ID checks and biometric verification performed on lotto9's behalf;
- Payment Processors — transaction confirmation data and fraud signals from GCash, Maya, BPI, BDO, Metrobank, and other payment partners;
- PAGCOR & Regulatory Authorities — information shared by PAGCOR or law enforcement in connection with regulatory compliance or investigations;
- Anti-Fraud & AML Screening Services — risk scores and watchlist screening results from compliance data providers.
5 Lawful Bases for Processing
Under the Data Privacy Act of 2012, lotto9 processes your personal data on the following lawful bases:
- Contractual Necessity — Processing is necessary for the performance of your Account agreement with lotto9, including account registration, processing deposits and withdrawals, delivering game services, and handling customer support requests.
- Legal Obligation — Processing is required by law or regulation, including PAGCOR licensing requirements, Know Your Customer (KYC) obligations, Anti-Money Laundering Act (AMLA) compliance, and tax reporting requirements under Philippine law.
- Consent — For certain non-essential processing activities, such as sending you promotional emails or SMS notifications about bonuses and new games, lotto9 relies on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time through your Account settings or by contacting support.
- Legitimate Interests — lotto9 may process your data where necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Legitimate interests include fraud detection and prevention, platform security, responsible gaming monitoring, and improving the overall quality of our services.
6 How We Use Your Personal Data
lotto9 uses the personal data we collect for the following purposes:
- Creating, verifying, and managing your lotto9 Account, including age verification to confirm you are 21 years of age or above;
- Processing your financial transactions, including deposits via GCash, Maya, QR Ph, GrabPay, bank transfers, and InstaPay, and processing withdrawal requests;
- Delivering and improving the games and services available on the lotto9 platform, including slots, live casino, bingo, sports betting, and sabong;
- Conducting KYC identity verification and ongoing due diligence in compliance with PAGCOR requirements and the Anti-Money Laundering Act;
- Monitoring gaming activity to identify indicators of problem gambling and to administer responsible gaming tools such as deposit limits, loss limits, and self-exclusion;
- Detecting, investigating, and preventing fraud, cheating, bonus abuse, money laundering, and other prohibited conduct as defined in our Terms & Conditions;
- Communicating with you regarding your Account, transactions, promotions, platform updates, and security alerts;
- Resolving disputes, responding to complaints, and maintaining records for regulatory and legal purposes;
- Complying with legal obligations, including responding to lawful requests from PAGCOR, the NPC, and other regulatory or law enforcement authorities;
- Sending you marketing communications about lotto9 promotions, new games, and special offers, where you have provided your consent to receive such communications.
Marketing Communications: You can opt out of receiving promotional emails and SMS from lotto9 at any time by updating your notification preferences in your Account settings, or by clicking the unsubscribe link in any marketing email. Opting out of marketing will not affect transactional or account-related communications, which are necessary for the operation of your Account.
7 Sharing Your Personal Data
lotto9 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients strictly on a need-to-know basis and subject to appropriate data protection safeguards:
- Payment Processors — GCash, Maya, BPI, BDO, Metrobank, GrabPay, InstaPay, PesoNet, and 7-Eleven CLiQQ, as necessary to process your financial transactions;
- KYC & Identity Verification Providers — third-party providers engaged by lotto9 to conduct identity checks, age verification, and document authentication;
- Cloud Infrastructure & Technology Partners — service providers that host, operate, or support the technical infrastructure underpinning the lotto9 platform;
- AML & Fraud Prevention Services — compliance technology providers used to screen transactions and accounts against sanctions lists and fraud databases;
- Regulatory & Law Enforcement Authorities — PAGCOR, the National Privacy Commission, the Anti-Money Laundering Council (AMLC), and other competent Philippine authorities, where disclosure is required by law or regulation;
- Legal & Professional Advisers — lawyers, auditors, and accountants engaged by lotto9 in connection with legal proceedings, regulatory audits, or corporate transactions, subject to professional confidentiality obligations;
- Successors in Business — in the event of a merger, acquisition, or sale of lotto9's business or assets, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.
All third-party service providers acting as Personal Information Processors on lotto9's behalf are bound by written data processing agreements that require them to process your data only on our instructions, implement appropriate security measures, and comply with the Data Privacy Act of 2012.
8 Cookies & Tracking Technologies
lotto9 uses cookies and similar tracking technologies on our platform to ensure proper functionality, enhance your user experience, and gather analytical data that helps us improve our services. By using the lotto9 platform, you consent to our use of cookies in accordance with this section.
8.1 Types of Cookies We Use
- Strictly Necessary Cookies — These are essential for the operation of the lotto9 platform. They enable core functions such as account login sessions, security authentication, and payment processing. These cookies cannot be disabled without impairing platform functionality.
- Functional Cookies — These remember your preferences, such as your chosen language, display settings, and responsible gaming configurations, so you do not need to reset them on each visit.
- Analytical Cookies — These collect anonymised or aggregated information about how players use the lotto9 platform — which games are most popular, how long sessions last, and where technical errors occur — to help us improve performance and user experience.
- Security & Fraud Prevention Cookies — These help lotto9 detect and prevent fraudulent activity, identify suspicious login attempts, and protect the integrity of our platform and your Account.
8.2 Managing Cookies
You can control and manage cookies through your web browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, or be notified when new cookies are set. Please note that disabling strictly necessary cookies will affect your ability to access and use core features of the lotto9 platform, including logging in to your Account.
9 Data Retention
lotto9 retains your personal data for as long as is necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods required by law and regulation:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & KYC Records | 5 years from account closure | PAGCOR regulatory requirement, AMLA |
| Financial Transaction Records | 5 years from transaction date | Anti-Money Laundering Act (RA 9160) |
| Gaming & Wager History | 3 years from the date of each session | PAGCOR licensing, dispute resolution |
| Customer Support Communications | 3 years from last interaction | Legitimate interests, dispute resolution |
| Marketing Consent Records | Until consent is withdrawn + 1 year | Consent management compliance |
| Technical / Log Data | 12 months from collection | Security monitoring, fraud detection |
Upon expiry of the applicable retention period, lotto9 will securely delete or anonymise your personal data. In the event that your data is required for ongoing legal proceedings, regulatory investigations, or dispute resolution, it may be retained for a longer period until the matter is fully resolved.
10 Security Measures
lotto9 takes the security of your personal data seriously. We implement a comprehensive range of technical and organisational security measures designed to protect your data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:
- SSL/TLS Encryption — all data transmitted between your device and the lotto9 platform is encrypted using industry-standard SSL/TLS protocols;
- Two-Factor Authentication (2FA) — optional 2FA is available for all lotto9 Accounts, adding an extra layer of protection against unauthorised login;
- Access Controls — access to personal data within lotto9's systems is restricted to authorised personnel on a strict need-to-know basis, with role-based access controls enforced;
- Pseudonymisation & Encryption at Rest — sensitive data fields are pseudonymised or encrypted in our databases to reduce risk in the event of a security breach;
- Regular Security Audits — lotto9 conducts periodic security assessments, penetration testing, and vulnerability scans to identify and remediate security weaknesses;
- Incident Response Plan — lotto9 maintains a documented data breach response procedure and will notify affected players and the National Privacy Commission in accordance with the Data Privacy Act in the event of a notifiable breach.
While lotto9 applies robust security measures, no system connected to the internet can be guaranteed to be completely secure. You are responsible for maintaining the confidentiality of your Account credentials. If you suspect that your Account has been compromised, contact lotto9 support immediately.
11 Your Privacy Rights
Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by lotto9. To exercise any of these rights, please contact our Data Protection Officer using the details in Section 15. lotto9 will respond to all verified rights requests within 15 business days of receipt.
Right to Access
Request a copy of the personal data lotto9 holds about you, along with information on how it is being used.
Right to Rectification
Request correction of any inaccurate or incomplete personal data we hold about you.
Right to Erasure
Request deletion of your personal data where we no longer have a lawful basis for retaining it, subject to our regulatory obligations.
Right to Object
Object to processing of your personal data based on legitimate interests, including direct marketing communications.
Right to Data Portability
Receive a structured, machine-readable copy of the personal data you provided to lotto9 for transfer to another service.
Right to Withdraw Consent
Withdraw any previously given consent to data processing at any time, without affecting the lawfulness of processing prior to withdrawal.
If you are not satisfied with lotto9's response to your privacy rights request, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines at privacy.gov.ph.
12 Children & Minors
Strict Age Restriction: The lotto9 platform is strictly for players who are 21 years of age or older, in accordance with Philippine law governing online gambling. lotto9 does not knowingly collect personal data from individuals under the age of 21.
lotto9 implements age verification procedures as part of the account registration and KYC process to prevent underage access to our platform. All new registrants are required to submit valid government-issued identification confirming they meet the minimum age requirement of 21 years before their Account is fully activated and deposits are permitted.
If lotto9 becomes aware that personal data has been collected from an individual below the age of 21 without appropriate parental or guardian consent, we will take immediate steps to suspend the relevant Account, return any deposited funds, and delete the personal data concerned in accordance with our data retention procedures. If you believe that a minor has registered an Account on lotto9, please contact our Data Protection Officer immediately using the details in Section 15.
13 Cross-Border Data Transfers
lotto9 primarily processes and stores personal data within secure data centre facilities. In certain cases, personal data may be transferred to, or processed by, service providers located outside the Philippines — for example, cloud infrastructure providers or international fraud screening services.
Where personal data is transferred outside the Philippines, lotto9 ensures that appropriate safeguards are in place to protect your data in accordance with the Data Privacy Act of 2012. These safeguards may include:
- Standard contractual clauses approved by the National Privacy Commission or equivalent data protection authorities;
- Data processing agreements requiring recipient organisations to implement security standards equivalent to those required under Philippine law;
- Transfers to countries or organisations that the NPC has recognised as providing an adequate level of data protection.
By using the lotto9 platform, you acknowledge that your personal data may be transferred internationally in accordance with the safeguards described in this section. If you have questions about specific cross-border transfers, please contact our Data Protection Officer.
14 Amendments to This Privacy Policy
lotto9 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data processing practices, new legal requirements, regulatory guidance from the National Privacy Commission or PAGCOR, or improvements to the lotto9 platform. All amendments will take effect upon publication of the updated Privacy Policy on the lotto9 website.
Where changes to this Privacy Policy are material — meaning they significantly affect your rights or the way we process your personal data — lotto9 will provide you with prior notice through a prominent notification on the lotto9 platform or via email to the address registered on your Account, at least 14 days before the changes take effect. Your continued use of the lotto9 platform after the effective date of any amendments constitutes your acceptance of the updated Privacy Policy.
We encourage you to review this Privacy Policy periodically. The "Last Updated" date at the top of this page indicates when the most recent revision was made.
15 Contact & Data Protection Officer
If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by lotto9, you may contact our Data Protection Officer using the following details:
Data Protection Officer — lotto9
Email: [email protected]
Subject line: Data Privacy Request – [Your Account Username]
lotto9 will acknowledge your request within 3 business days and provide a substantive response within 15 business days. For complex requests, we may require additional time and will notify you accordingly.
If you are not satisfied with lotto9's handling of your privacy request or complaint, you have the right to escalate the matter to the National Privacy Commission (NPC) of the Philippines, which is the competent supervisory authority under the Data Privacy Act of 2012.
Your Privacy Is Protected.
Your Game Awaits.
Now that you know how lotto9 keeps your personal data safe, dive into the Philippines' most exciting online gaming platform — slots, live casino, bingo, sabong, and more. Play with confidence.
Have questions about your data? Review our FAQ or visit our Responsible Gaming page. 21+ only. Play responsibly.