GDLotto is committed to protecting the personal data of every player on our platform. This Privacy Policy sets out in full how we collect, process, store, and protect your information — and what rights you have over your own data as a Malaysian player.
Last Updated: 1 January 2026This Privacy Policy ("Policy") is issued by GDLotto ("GDLotto", "we", "us", "our") and applies to all personal data collected, processed, and stored in connection with your use of the GDLotto platform accessible at gdlotto.cam and all associated products and services (collectively, the "Platform").
GDLotto takes the privacy and security of your personal data seriously. This Policy explains what personal data we collect from you, why we collect it, how we use and protect it, who we may share it with, and what rights you have in relation to your data. It applies to all registered players, visitors to the Platform, and any individual whose personal data GDLotto processes.
By registering for an account on GDLotto or by continuing to use the Platform, you acknowledge that you have read and understood this Policy and that you consent to the collection and processing of your personal data as described herein. If you do not agree with any part of this Policy, you should not use the Platform.
📌 Related Documents: This Policy should be read together with GDLotto's Terms & Conditions and Responsible Gambling Policy, both of which contain additional information relevant to your use of the Platform.
In this Policy, the following terms carry the meanings set out below unless the context requires otherwise:
| Term | Meaning |
|---|---|
| Personal Data | Any information that identifies or can be used to identify a living individual, directly or indirectly — including name, identification number, contact details, IP address, and behavioural data. |
| Processing | Any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, or deletion. |
| Data Controller | GDLotto — the entity that determines the purposes and means of processing your personal data. |
| Data Processor | Any third-party service provider engaged by GDLotto to process personal data on its behalf in accordance with this Policy. |
| Consent | A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data for a stated purpose. |
| KYC | Know Your Customer — the identity and address verification process required to comply with anti-money laundering and regulatory obligations. |
| Cookies | Small text files stored on your device by your web browser when you visit the Platform, used to facilitate functionality, analytics, and personalisation. |
GDLotto collects personal data in the following categories, depending on how you interact with the Platform:
3.1 Registration & Account Data
3.2 Identity Verification (KYC) Data
3.3 Financial & Transaction Data
3.4 Gameplay & Behavioural Data
3.5 Technical & Device Data
GDLotto processes your personal data only for legitimate purposes that are directly connected to the operation of the Platform and our obligations to you and to regulatory authorities. The primary purposes for which we use your data are:
GDLotto processes your personal data on one or more of the following lawful bases:
| Legal Basis | Applicable Processing Activities |
|---|---|
| Contractual Necessity | Account registration, transaction processing, gameplay delivery, customer support — all required to perform the contract between GDLotto and the player. |
| Legal Obligation | KYC identity verification, AML monitoring, regulatory reporting — required to comply with applicable licensing and financial regulation. |
| Legitimate Interests | Fraud detection, Platform security, abuse prevention, service analytics — carried out in GDLotto's legitimate interest in maintaining a safe, functional Platform. |
| Consent | Marketing communications, optional cookies beyond strictly necessary — processed only where you have expressly opted in. |
| Vital Interests | Responsible gambling interventions where there is a serious concern for the wellbeing of a player. |
GDLotto does not sell, rent, or trade your personal data to third parties for commercial purposes. However, we may share your data in the following circumstances:
All third parties who process data on GDLotto's behalf are bound by written data processing agreements requiring them to handle your data in accordance with applicable data protection standards.
GDLotto retains personal data for as long as is necessary to fulfil the purposes for which it was collected, including satisfying our legal, accounting, and regulatory obligations. The following general retention principles apply:
Upon the expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with GDLotto's internal data management procedures.
GDLotto implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:
🔐 Your Role in Security: While GDLotto takes extensive measures to protect your data, you also play a critical role. Keep your password secure, enable 2FA, and never share your login credentials with anyone. Contact [email protected] immediately if you suspect unauthorised access to your account.
Subject to applicable data protection law and GDLotto's legal obligations, you have the following rights in relation to your personal data. To exercise any of these rights, please contact GDLotto at [email protected].
You may request a copy of all personal data GDLotto holds about you, along with information about how it is being processed.
If your personal data is inaccurate or incomplete, you have the right to request that it be corrected or updated.
Subject to our legal retention obligations, you may request the deletion of your personal data where it is no longer necessary for its original purpose.
In certain circumstances, you may request that GDLotto suspend processing of your data while a dispute or accuracy concern is investigated.
Where processing is based on consent or contractual necessity, you may request your data in a structured, machine-readable format.
You may object to processing based on legitimate interests, including direct marketing. Objections to marketing will be acted on immediately.
GDLotto will respond to all valid data subject requests within thirty (30) days of receipt. In complex cases, this period may be extended by an additional sixty (60) days, and you will be notified accordingly.
Please note that certain rights may be limited where GDLotto is required to retain your data to meet legal obligations — for example, AML record-keeping requirements that apply after account closure.
GDLotto is strictly for players aged 21 and above. The Platform does not knowingly collect, process, or store personal data of individuals under the age of 21. If GDLotto discovers or has reasonable grounds to believe that an account has been opened by or on behalf of a person under 21, the account will be immediately suspended and all associated personal data will be securely deleted in accordance with our data retention policy, subject to any mandatory regulatory retention obligations.
🔞 Age Verification: GDLotto uses KYC identity verification to confirm that all players meet the 21+ age requirement. If you suspect that a minor has accessed the Platform using your details, contact us immediately at [email protected].
The GDLotto Platform may incorporate content, tools, or functionality provided by third-party service providers, including game content providers, payment processors, and analytics tools. GDLotto is not responsible for the privacy practices of third-party services that operate independently of the Platform.
This Policy applies solely to data processed by GDLotto as Data Controller. When your data is transferred to a third-party Data Processor, that party is bound by a data processing agreement with GDLotto and may only process your data for the purposes specified by GDLotto.
As an international online gaming platform, GDLotto operates on infrastructure that may involve the transfer of personal data to servers and service providers located outside Malaysia. Where such transfers occur, GDLotto ensures that adequate safeguards are in place to protect your data, including:
By using the GDLotto Platform, you acknowledge and consent to the transfer of your personal data to international jurisdictions as described in this section, subject at all times to the safeguards above.
GDLotto reserves the right to update or amend this Privacy Policy at any time. Where changes are material, we will notify you by posting a prominent notice on the Platform or by sending a notification to the email address registered with your account. The "Last Updated" date at the top of this Policy reflects when it was most recently revised.
Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the revised terms. If you disagree with any changes, you may request account closure by contacting our support team.
If you have any questions, requests, or concerns regarding this Privacy Policy or the manner in which GDLotto handles your personal data, please contact our Data Privacy team through the following channels:
📌 Exercise Your Rights: To submit a data subject rights request — including access, erasure, or objection — please email [email protected] with the subject line "Data Rights Request" and your registered account email. We will respond within 30 days.
Our privacy commitments aren't just words on a page. Here's what they look like in practice for every Malaysian player on GDLotto.
All data transmitted between your device and GDLotto is protected by 256-bit TLS encryption — the same standard used by major banks and financial institutions worldwide.
GDLotto never sells your personal data to third-party advertisers, data brokers, or any other commercial party. Your data is used solely to operate and improve the Platform.
Every piece of data we collect is tied to a specific, documented purpose. We do not collect data "just in case" — if we don't need it to serve you, we don't keep it.
Access, rectify, erase, or port your data at any time by contacting our team. We respond to all data subject requests within 30 days — no deflection, no unnecessary delays.
Internal access to player personal data at GDLotto is granted on a strict need-to-know basis. All staff with data access are bound by formal confidentiality and security obligations.
We don't keep data indefinitely. Retention periods are defined, documented, and enforced — data is securely deleted or anonymised once the retention period expires.
Our support team is available around the clock to address any privacy concern, data request, or question about how GDLotto handles your information.