This notice explains what loto9 does with the personal information you hand over when you register, deposit and play. It covers players in Malaysia using our website and the loto9 app, and it applies from the moment an account is opened until the last record is cleared.
Which details does loto9 collect from you?
Three kinds of information pass through our system. Account details are the ones you type in yourself. Transaction records come from the payment channels you choose. Technical data is created automatically when your browser or the loto9 app connects to our servers. We do not buy player lists and we do not gather anything unrelated to running your account.
| Category | What it includes | Why we hold it |
|---|---|---|
| Account details | Full name, NRIC or passport number, date of birth, mobile number, home address | Confirms you are at least 18 and links every payout to the right person |
| Transaction records | Deposits, bets, bonus claims and withdrawals made through Touch 'n Go eWallet, DuitNow, FPX Online Banking or Bank Transfer | Settles payments and calculates daily cashback correctly |
| Verification files | A photo of your NRIC, passport or driving licence, plus a selfie when a check needs clearing up | Completes KYC before the first withdrawal is released |
| Technical data | Device model, browser version, IP address, login and logout times | Flags unusual logins and blocks accounts used for fraud |
Why we need each piece of information
Every field on the registration form has a job. Your date of birth proves you are 18 or older. Your mobile number carries the one-time code used at login and for password resets. Your bank or e-wallet details are how money moves in and out. Malaysian anti-money-laundering rules also require loto9 to record who deposited what and when.
Marketing sits apart from all of that. Promotional SMS and email are optional, and you can switch them off inside your account settings without losing access to games, bonuses or support.
Who else handles your data when you play at loto9
loto9 does not sell personal data. We pass a limited set of details to suppliers who make specific parts of the service work:
- Payment providers receive your name, account number and the amount, so a transfer can clear.
- Game studios in the loto9 game lobby, including PG Soft, Ezugi, Playtech, JDB, Evolution and Sexy Gaming, receive a player ID so your progress and balances stay in sync. They never see your identity documents.
- Identity reviewers check the documents you upload for the KYC step.
- Support tools store chat transcripts so a case can be picked up by another agent.
What those suppliers may do
Each supplier works under a contract that limits them to the task they were hired for. They cannot use your data for their own marketing, and they must delete it once the contract ends.
Legal requests
loto9 will disclose information to a regulator, the police or a court when a valid written request is served under Malaysian law. Where the law allows it, we tell the account holder what was requested.
What we keep after you close your account
Closing an account is not the same as erasing every trace of it. Shutting down your loto9 account stops gameplay use immediately: your profile leaves the active database, marketing stops, and the login is disabled.
Records that stay behind
Payment history, bonus claims and completed identity checks are moved to a read-only archive. Record-keeping rules require us to answer an auditor or a bank dispute long after the account is gone, so those files remain available to the compliance team only.
Where deletion has to wait
If a withdrawal is still moving or a bonus is still being wagered, the related records are held until the case closes. A withdrawal normally clears in about 41 minutes, so this pause is usually short.
How loto9 keeps account data locked down
Traffic between your device and loto9 runs over an encrypted connection. Passwords are stored as salted hashes, never as readable text, so nobody at our end can see them. Access to player records is limited to staff with a reason to look, and every lookup is written to an audit trail.
The loto9 app for Android, version 3.7.0, asks only for the permissions it needs to run. It does not read your contacts, your photo gallery or your call log. If a breach ever put player data at risk, affected accounts would be contacted directly through the app inbox and the registered mobile number.
What sits on your phone after you visit loto9
Cookies and similar browser storage keep a session alive and remember small preferences, such as your language and the RM currency display. None of them contain your password or your full NRIC number.
| Type | What it does | Can you refuse it? |
|---|---|---|
| Strictly necessary | Holds your session while you play and keeps the login secure | No, login stops working without it |
| Preferences | Remembers language and currency settings on your device | Yes, from browser settings |
| Analytics | Shows which loto9 pages load slowly on mobile networks | Yes, opt out in account settings |
| Marketing | Caps how often the same promotion is shown | Yes, at any time |
What you can ask us to do with your details
Malaysia's Personal Data Protection Act gives you control over your own information, and loto9 applies the same rules to every account. You may ask us to:
- Show you a copy of the personal data held against your loto9 account.
- Correct anything wrong, such as a misspelled name or an outdated address.
- Withdraw consent for marketing while keeping the account open.
- Close the account and request deletion of anything the law does not require us to keep.
- Explain how a particular decision about your account was reached.
We confirm identity before acting on a request, so have your registered mobile number ready. Because of record-keeping duties, data attached to a completed deposit or an unwagered bonus cannot be deleted on demand.
When this notice gets revised
Rules change and this page changes with them. If a revision alters how loto9 uses your information, the new version appears here and is flagged in your account inbox before it takes effect. Corrections to wording or layout go live quietly. The version published on this page is the one that applies to your account.
Where do I send a privacy question?
Live chat is staffed 24/7 and is the quickest route for anything data related. Open it from any page, type the word privacy in your first message, and the chat routes straight to the compliance desk instead of general support. There is no email address to remember; every request runs through chat or the help center, and you get a reference number to follow up with.
Still weighing it up? The loto9 register page lists every field before you type anything, and the home page shows what the account unlocks.