Privacy Policy — my4dlotto

my4dlotto ("the Company", "we", "us", "our") is committed to protecting the privacy and personal data of all individuals who access or use the my4dlotto platform, including the website at my4dlotto.cam, associated subdomains, and any mobile applications (collectively, the "Platform").

This Privacy Policy ("Policy") describes how we collect, use, store, share, and protect personal data in connection with your use of the Platform. It also sets out the rights available to you regarding your personal data and explains how you may exercise those rights.

This Policy should be read alongside our Terms & Conditions and Responsible Gambling Policy. By registering an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" — any information that identifies or could reasonably be used to identify a living individual, either alone or in combination with other data.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, erasure, or destruction.
• "Data Controller" — the Company, which determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" — a third party that processes Personal Data on behalf of the Company, strictly in accordance with our instructions and this Policy.
• "KYC" — Know Your Customer verification, the process of verifying a player's identity and age to comply with anti-money-laundering and gaming licence requirements.
• "Cookies" — small text files placed on your device by our Platform for purposes of session management, preference storage, and analytics.
• "Player" — any individual who has registered a verified account on the Platform.

We collect the following categories of Personal Data from players and Platform visitors:

We collect Personal Data through the following means:

• Directly from you — when you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or update your account settings.
• Automatically — when you access and navigate the Platform, through cookies, server logs, and analytics tools that record technical and usage data.
• From third parties — from identity verification providers, payment processors (including Maybank, CIMB, Public Bank, Hong Leong, FPX network, DuitNow, Touch 'n Go, Boost, and GrabPay), fraud detection services, and, where applicable, from other gaming platforms where you have consented to data sharing for responsible gambling purposes (e.g., self-exclusion databases).

We process your Personal Data for the following purposes:

1. Account Registration and Management: To create and maintain your player account, authenticate your identity at login, and administer account settings.
2. KYC and Age Verification: To verify that you meet the minimum age requirement of 21 years and to comply with anti-money-laundering (AML) obligations under our international gaming licence.
3. Payment Processing: To process MYR deposits and withdrawals through your chosen payment method, and to maintain accurate transaction records.
4. Gaming Service Delivery: To operate, personalise, and continuously improve your gaming experience across 4D lottery, live casino, slots, and sports betting products.
5. Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, collusion, money laundering, and other prohibited conduct on the Platform.
6. Responsible Gambling Compliance: To monitor gaming behaviour, apply player-set limits, and intervene where patterns suggest problematic gambling activity.
7. Customer Support: To respond to your enquiries, resolve disputes, and maintain records of communications for quality assurance purposes.
8. Legal Compliance: To comply with applicable legal obligations including our gaming licence conditions, AML obligations, and any lawful requests from competent authorities.
9. Marketing Communications (where consented): To send you promotional offers, bonus notifications, and platform updates via your preferred channel, strictly where you have provided valid consent to receive such communications.
10. Platform Analytics and Improvement: To analyse usage patterns, identify technical issues, and inform product development decisions.

We process your Personal Data on one or more of the following legal bases, depending on the specific activity:

• Contractual Necessity: Processing required to fulfil our obligations under the Terms & Conditions agreed at registration, including account management, payment processing, and game delivery.
• Legal Obligation: Processing required to comply with our international gaming licence conditions, AML regulations, and any applicable data protection obligations.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gambling monitoring, and analytics, where our interests do not override your fundamental rights.
• Consent: Processing for marketing communications, where we rely on your explicit, freely given, and revocable consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

my4dlotto does not sell, rent, or trade Personal Data to third parties. We may share your Personal Data with the following categories of recipients, strictly for the purposes described in Section 5:

• Payment Processors: Financial institutions and e-wallet operators (including those operating Maybank2u, CIMB Clicks, Public Bank, DuitNow, FPX, Touch 'n Go eWallet, Boost, and GrabPay) for the purpose of processing your deposits and withdrawals in MYR.
• Identity Verification Providers: Third-party KYC service providers who assist in verifying your identity and age using the documentation you submit.
• Fraud and Security Services: Providers of fraud detection, AML screening, and cybersecurity services that help us protect the integrity of the Platform.
• Gaming Technology Providers: Third-party game studios and platform technology vendors who require limited data to deliver games and technical services.
• Analytics Providers: Platform analytics services that process technical and usage data in aggregated or pseudonymised form to help us improve our services.
• Regulatory and Legal Authorities: Competent government or regulatory bodies where disclosure is required by law or our licence conditions, including in response to lawful court orders or law enforcement requests.
• Professional Advisers: Legal counsel, auditors, and accountants, where necessary and subject to confidentiality obligations.

We retain Personal Data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law or our gaming licence conditions. The following general retention periods apply:

• Account Data and KYC Records: Retained for the duration of your account registration plus a minimum of five (5) years following account closure, in accordance with AML compliance obligations.
• Financial Transaction Records: Retained for a minimum of seven (7) years following the transaction date, as required for financial auditing and regulatory purposes.
• Gaming Session Logs: Retained for a minimum of three (3) years following each session, for dispute resolution and responsible gambling monitoring purposes.
• Marketing Consent Records: Retained for the duration of your consent and for a period thereafter as evidence of your consent or opt-out status.
• Support Communications: Retained for three (3) years following the resolution of the relevant enquiry or dispute.

Upon expiry of the applicable retention period, Personal Data is securely deleted or anonymised such that it can no longer be associated with you as an individual.

The Company implements industry-standard technical and organisational security measures to protect your Personal Data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• 256-bit TLS/SSL encryption for all data transmitted between your device and our Platform.
• Encryption at rest for sensitive data fields including identity documents, payment account details, and KYC records.
• Role-based access controls ensuring that Personal Data is accessible only to employees whose job functions require it.
• Two-factor authentication (2FA) available for all player accounts and mandatory for administrative access.
• Regular security audits, penetration testing, and vulnerability assessments conducted by qualified third-party security professionals.
• Incident response procedures with defined timelines for breach notification where required.

While we take all reasonable steps to protect your data, no internet transmission or electronic storage system is completely impenetrable. You are encouraged to use a strong, unique password for your my4dlotto account and to enable two-factor authentication.

my4dlotto uses cookies and similar tracking technologies to operate and improve the Platform. The following categories of cookies are in use:

• Essential Cookies: Required for basic Platform functionality including user authentication, session management, and security. These cannot be disabled without impairing your use of the Platform.
• Functional Cookies: Remember your preferences and settings (such as language, currency display, and responsible gambling limits) to provide a personalised experience.
• Analytics Cookies: Collect aggregated, pseudonymised data on how players navigate and use the Platform, enabling us to identify performance issues and improve the user experience.
• Security Cookies: Detect and prevent fraudulent activity, suspicious login patterns, and automated attacks on the Platform.

You may manage or delete cookies through your browser settings. Please note that disabling essential or functional cookies may affect your ability to use certain features of the Platform. my4dlotto does not use third-party advertising or behavioural targeting cookies.

As an internationally licensed gaming platform, some of your Personal Data may be processed by our service providers in countries outside Malaysia. Where such transfers occur, they are limited to service providers who are essential to the operation of the Platform and are governed by the following safeguards:

• Data Processing Agreements (DPAs) that impose obligations on receiving parties consistent with applicable data protection standards.
• Restrictions limiting the use of transferred data strictly to the purpose for which it was shared.
• Technical security requirements equivalent to those applied within our own infrastructure.

By using the Platform, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside Malaysia where data protection laws may differ. The Company takes all reasonable steps to ensure that such transfers are conducted in accordance with this Policy.

The Platform is strictly for individuals aged 21 years and above. my4dlotto does not knowingly collect or process Personal Data from individuals under the age of 21. Age verification is a mandatory step in the account registration process and is confirmed again at the point of KYC submission.

If we become aware that Personal Data has been collected from an individual under the age of 21 — whether through misrepresentation at registration or any other means — we will immediately suspend the relevant account, void any associated transactions, and permanently delete the data of the underage individual from our systems.

Subject to applicable law and our legal retention obligations, you have the following rights in respect of your Personal Data held by my4dlotto:

• Right of Access: You may request a copy of the Personal Data we hold about you and information about how it is processed.
• Right to Rectification: You may request correction of any inaccurate or incomplete Personal Data. Some corrections can be made directly within your account settings.
• Right to Erasure: You may request deletion of your Personal Data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations (particularly for KYC and financial records).
• Right to Restrict Processing: You may request that we limit how we use your data in certain circumstances, for example while a dispute is being resolved.
• Right to Data Portability: Where processing is based on your consent or contract performance, you may request that we provide your Personal Data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on our legitimate interests, including for marketing purposes, at any time.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us at [email protected] with the subject line "Data Rights Request". We will respond within thirty (30) days. In some cases, we may require identity verification before processing your request.

Where you have provided consent at registration or subsequently through your account settings, my4dlotto may contact you with promotional offers, bonus notifications, deposit reminders, and platform updates via email or SMS.

Opting Out: You may withdraw your marketing consent and unsubscribe from promotional communications at any time by:

• Updating your communication preferences in your account settings under "Notification Preferences".
• Contacting our support team at [email protected] with the subject line "Unsubscribe".

Please allow up to five (5) business days for opt-out requests to take effect across all communication channels. Please note that even after opting out of marketing communications, you will continue to receive transactional and account-related notifications (such as deposit confirmations, withdrawal updates, and security alerts) which are essential to the operation of your account.

The Company reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or regulatory requirements. Where changes are material, we will notify registered players via email or through a prominent notice on the Platform at least fourteen (14) days before the changes take effect.

The updated Policy will be published on this page with a revised effective date. Your continued use of the Platform following the effective date of any amendment constitutes your acknowledgement of the updated Policy. If you do not agree with any changes, you must close your account before the effective date of the amendment.

We encourage you to review this Policy periodically to remain informed about how we protect your personal data.

For any questions, concerns, or requests relating to this Privacy Policy or your Personal Data, please contact the my4dlotto Data Protection team through the following channels:

• Email: [email protected] — please use the subject line "Privacy Enquiry" or "Data Rights Request" as applicable.
• Live Chat: Available 24 hours a day, 7 days a week via the Platform's live chat function. Average response time is under 90 seconds.

When submitting a privacy-related enquiry, please include your registered Account username and a clear description of your request. We will acknowledge receipt within two (2) business days and aim to provide a full response within thirty (30) days.

For responsible gambling support, please also visit our Responsible Gambling page.