mlotto Privacy Policy

1. Data Controller Information

1.1 The data controller responsible for your personal information collected through the mlotto platform is the entity operating mlotto under its PAGCOR license. mlotto is accessible at https://mlotto.bet and serves players across the Philippines, including Manila, Cebu, Davao, Quezon City, Makati, and other cities and municipalities throughout the archipelago.

1.2 As data controller, mlotto determines the purposes and means of processing your personal data. All data processing activities are conducted in accordance with the Data Privacy Act of 2012 (RA 10173), PAGCOR regulatory requirements, and the Anti-Money Laundering Act (AMLA) of the Philippines.

1.3 mlotto has appointed a Data Protection Officer (DPO) to oversee compliance with the Data Privacy Act of 2012 and to serve as the primary point of contact for all data privacy matters. The DPO may be reached at [email protected]. All data privacy inquiries, complaints, and rights-exercise requests should be directed to this contact.

2. Personal Data We Collect

2.1 mlotto collects personal data through several channels: directly from you during registration and account use, automatically through your interaction with the platform, and from third-party verification and payment service providers. The categories of personal data we collect are set out in the table below.

2.2 mlotto does not knowingly collect sensitive personal information as defined under Section 3(l) of the Data Privacy Act of 2012 (e.g., racial or ethnic origin, political opinions, religious beliefs, health data, sexual life) unless expressly required for responsible gaming assessments or as mandated by PAGCOR regulation. Where such collection becomes necessary, you will be given a separate, specific consent notice.

2.3 Where you choose not to provide personal data that is required for a specific purpose (e.g., KYC documentation required for withdrawals), mlotto may be unable to provide that particular service or feature. We will always make clear which data fields are mandatory and which are optional.

3. Legal Basis for Processing

3.1 Under the Data Privacy Act of 2012, mlotto processes your personal data on one or more of the following lawful bases:

• Contractual Necessity: Processing is necessary to perform our contract with you — i.e., to operate your player account, process deposits and withdrawals, and provide access to games and services on the mlotto platform.
• Legal Obligation: Processing is required for mlotto to comply with legal obligations under Philippine law, including PAGCOR licensing conditions, the Anti-Money Laundering Act (AMLA), and the Data Privacy Act of 2012.
• Legitimate Interests: Processing is necessary for mlotto's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and service improvement — provided these interests are not overridden by your rights and freedoms.
• Consent: For specific processing activities not covered by the above bases (e.g., optional marketing communications), we will obtain your explicit prior consent. You may withdraw consent at any time without affecting the lawfulness of processing already carried out.

4. How We Use Your Data

4.1 mlotto uses the personal data we collect for the following specific purposes:

• Account Management: Creating and maintaining your mlotto player account, verifying your identity at registration and through ongoing KYC procedures, and managing your account settings and preferences.
• Payment Processing: Facilitating deposits and withdrawals via GCash, Maya, BPI, BDO, Metrobank, InstaPay, PesoNet, GrabPay, QR Ph, and 7-Eleven CLiQQ; verifying that payment accounts are registered in your name; and maintaining accurate transaction records.
• Regulatory Compliance: Meeting PAGCOR reporting obligations, conducting AML screening and transaction monitoring as required under the Anti-Money Laundering Act, and providing data to Philippine authorities upon lawful request.
• Fraud Prevention and Security: Detecting, investigating, and preventing fraudulent activity, unauthorized account access, bonus abuse, money laundering, and other prohibited conduct on the mlotto platform.
• Responsible Gaming: Monitoring gaming behavior for indicators of problem gambling, providing self-exclusion and deposit limit tools, and complying with PAGCOR's responsible gaming framework.
• Customer Support: Responding to your inquiries, resolving disputes, and improving the quality of our support services using historical interaction data.
• Platform Improvement: Analyzing aggregated, anonymized usage data to improve game offerings, website performance, and the overall player experience on mlotto.
• Marketing Communications (Consent-Based Only): Sending promotional offers, bonus notifications, and platform news to players who have opted in to marketing communications. You may opt out at any time by contacting [email protected].

5. Data Sharing & Disclosure

5.1 mlotto does not sell, rent, or trade your personal data to any third party. We may share your personal data only in the following circumstances and with the following categories of recipients:

5.2 Service Providers & Processors

mlotto engages trusted third-party service providers who process personal data on our behalf and under our instruction, solely for the purposes described in this Policy. These include:

• Payment processors and e-wallet providers (GCash, Maya, GrabPay, InstaPay, PesoNet, and banking partners)
• KYC and identity verification service providers
• Game software providers (who may collect technical data for game functionality purposes)
• Cloud infrastructure and data hosting providers
• Customer support platform providers
• Fraud detection and AML screening service providers

All third-party processors are bound by data processing agreements that require them to maintain confidentiality, implement appropriate security measures, and process data only as directed by mlotto.

5.3 Regulatory and Legal Disclosure

mlotto may disclose your personal data to the following authorities where required by law or regulation:

• PAGCOR (Philippine Amusement and Gaming Corporation) — for licensing compliance and regulatory reporting
• AMLC (Anti-Money Laundering Council of the Philippines) — for AML reporting obligations under RA 9160 as amended
• National Privacy Commission (NPC) — in connection with data privacy complaints or investigations
• Philippine law enforcement agencies — where required by a valid court order, subpoena, or other lawful process

5.4 Business Transfers

5.4 In the event of a merger, acquisition, or sale of all or substantially all of mlotto's assets, your personal data may be transferred to the acquiring entity as part of that transaction, subject to equivalent data protection obligations. You will be notified of any such transfer and its privacy implications in advance.

6. Data Security Measures

6.1 mlotto implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, destruction, or accidental loss. These measures include:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using 256-bit SSL/TLS encryption. Our platform enforces HTTPS across all pages and API endpoints.
• Encryption at Rest: Sensitive personal data stored on mlotto servers, including KYC documents and financial records, is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data is restricted to mlotto personnel and authorized service providers who require it to perform their duties. Role-based access controls and multi-factor authentication are enforced for all staff with access to player data.
• Password Security: Player account passwords are stored using industry-standard one-way cryptographic hashing. mlotto staff cannot view your password in plain text.
• Security Monitoring: Our platform is monitored 24/7 for unauthorized access attempts, unusual activity, and potential security incidents using automated intrusion detection systems.
• Data Breach Response: In the unlikely event of a data breach that poses a risk to your rights and freedoms, mlotto will notify the National Privacy Commission within 72 hours of becoming aware of the breach, and affected players will be notified without undue delay.

6.2 While mlotto takes all reasonable precautions to protect your data, no online platform can guarantee absolute security. You are responsible for maintaining the confidentiality of your own mlotto account credentials and for notifying us immediately at [email protected] if you suspect any unauthorized access to your account.

7. Data Retention

7.1 mlotto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, and to comply with applicable legal, regulatory, and PAGCOR requirements. Our standard retention periods are as follows:

7.2 Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Where data cannot be immediately deleted due to ongoing legal proceedings or regulatory investigations, it will be segregated and restricted from further processing until deletion is possible.

8. Cookies & Tracking Technologies

8.1 mlotto uses cookies and similar tracking technologies to enhance your experience on the platform, maintain session security, and collect anonymized analytics data for platform improvement. Cookies are small text files stored on your device by your browser.

8.2 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the platform to function. These include session authentication cookies that keep you logged in securely. These cookies cannot be disabled without breaking platform functionality.
• Performance & Analytics Cookies: Collect anonymized data about how players use the mlotto platform (e.g., pages visited, session duration) to help us improve platform performance and user experience.
• Functionality Cookies: Remember your preferences (e.g., language settings, game lobby filters) to personalize your mlotto experience.
• Security Cookies: Used for fraud detection and prevention, including detecting unusual login patterns or suspicious activity on your account.

8.3 mlotto does not use third-party advertising cookies or cross-site tracking pixels. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to log in and use the platform.

9. Your Privacy Rights

9.1 As a data subject under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by mlotto. To exercise any of these rights, submit a written request to [email protected] with your full name, registered email address, and a description of your request. mlotto will respond within 15 business days of receiving a verified request.

9.2 Please note that some rights are subject to limitations under the Data Privacy Act of 2012 and other applicable Philippine laws. For example, the right to erasure does not apply where retention is required by PAGCOR or AMLA regulations. mlotto will always explain the basis for any limitation applied to a rights request.

10. Children & Minors

10.1 mlotto does not knowingly collect personal data from individuals under the age of 21. Age verification is conducted as part of the registration process and through mandatory KYC procedures. Any account found to belong to a person under 21 will be immediately closed and all personal data associated with that account deleted, except where retention is required for legal compliance purposes.

10.2 If you are a parent or guardian and believe that a minor has registered an account on mlotto or provided personal data to our platform, please contact us immediately at [email protected]. We will take prompt action to close the account and remove the data.

11. Cross-Border Data Transfers

11.1 Some of the third-party service providers engaged by mlotto — including cloud infrastructure providers and game software suppliers — may process or store personal data outside of the Philippines. Where such cross-border transfers occur, mlotto ensures they are conducted in compliance with Section 21 of the Data Privacy Act of 2012 and the relevant NPC guidelines on cross-border data transfers.

11.2 Safeguards applied to cross-border transfers include contractual clauses requiring the recipient to maintain data protection standards equivalent to those required under Philippine law, and where applicable, adequacy assessments of the recipient country's data protection framework.

11.3 mlotto does not transfer personal data to jurisdictions that lack adequate data protection frameworks without implementing additional contractual or technical safeguards to protect your rights.

12. Contact & Data Protection Officer

12.1 For any questions, concerns, or requests relating to this Privacy Policy or to your personal data held by mlotto, please contact our Data Protection Officer:

12.2 For responsible gaming-related privacy concerns — including data relating to self-exclusion records — please visit our Responsible Gaming page or contact our DPO directly.

12.3 For questions about our Terms and Conditions and how they relate to data processing, please review our Terms & Conditions page.

This Privacy Policy was last reviewed and updated on January 1, 2026. mlotto reserves the right to update this Policy at any time to reflect changes in applicable law, PAGCOR requirements, or our data processing practices. The most current version will always be published at https://mlotto.bet/privacy-policy. Material changes will be communicated to registered players via email prior to taking effect.