At Loto8, we take the privacy of every Filipino player seriously. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over your information. Please read this document carefully before registering an account.
This Privacy Policy ("Policy") describes how Loto8 ("Loto8," "we," "us," or "our") collects, uses, stores, discloses, and protects the personal information of individuals ("you," "Player," or "User") who access or use the Loto8 online gaming platform, including the website at loto8.net and any associated mobile application (collectively, the "Platform").
Loto8 is committed to protecting the privacy and personal data of all players in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines and its Implementing Rules and Regulations, as administered by the National Privacy Commission (NPC). By registering an account or using the Platform, you consent to the collection and processing of your personal data as described in this Policy.
This Policy should be read together with our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated herein by reference. If you do not agree with this Policy, you must not use the Platform.
For the purposes of the Data Privacy Act of 2012 and this Policy, Loto8 acts as the Personal Information Controller (PIC) in respect of the personal data collected through the Platform. As PIC, Loto8 determines the purposes and means of processing your personal information.
Where Loto8 engages third-party service providers to process personal data on its behalf — such as payment processors, identity verification providers, and cloud infrastructure providers — those parties act as Personal Information Processors (PIPs) and are contractually bound to process your data only in accordance with Loto8's instructions and applicable data protection law.
For all data privacy inquiries, requests, and complaints, please contact our Data Protection Officer (DPO) using the contact details provided in Section 14 of this Policy.
Loto8 collects the following categories of personal data from players and Platform users. We collect only the data that is necessary for the purposes described in this Policy.
Loto8 collects personal data through the following means:
Loto8 processes your personal data only where there is a lawful basis for doing so under the Data Privacy Act of 2012. The following table summarizes the primary purposes for which we process your data and the corresponding legal basis.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account registration and management | Identity, contact data | Contract performance |
| Identity verification (KYC) and age verification (21+) | Identity data, government ID | Legal obligation; contract performance |
| Processing deposits and withdrawals in PHP | Financial data, identity data | Contract performance |
| Fraud prevention and anti-money laundering compliance | Identity, financial, technical data | Legal obligation; legitimate interest |
| Responsible gaming monitoring and enforcement | Gaming history, self-exclusion records | Legal obligation; legitimate interest |
| Customer support and dispute resolution | Communications, account data | Contract performance; legitimate interest |
| Platform security and technical operations | Technical and usage data | Legitimate interest |
| Regulatory reporting and compliance | Identity, financial, gaming data | Legal obligation |
| Service improvement and analytics | Usage and technical data (aggregated) | Legitimate interest |
| Sending account-related notifications | Contact data | Contract performance |
| Sending promotional communications (where opted in) | Contact data, gaming preferences | Consent |
Where Loto8 relies on your consent as the legal basis for processing — such as for sending promotional communications — you have the right to withdraw that consent at any time by updating your notification preferences in your account settings or by contacting our support team. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Loto8 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients only to the extent necessary for the purposes described in this Policy:
Loto8 engages trusted third-party service providers to assist in operating the Platform. These include payment processors (GCash, PayMaya, BPI, BDO, Metrobank), identity verification providers, cloud hosting and infrastructure providers, customer support platform providers, and analytics service providers. All such providers are contractually bound to process your data only on Loto8's instructions and in compliance with applicable data protection law.
Loto8 may disclose your personal data to government agencies, regulatory bodies, or law enforcement authorities where required to do so by applicable Philippine law, court order, or regulatory directive. This includes disclosures required for anti-money laundering compliance, tax reporting, and gaming regulatory oversight.
In the event of a merger, acquisition, restructuring, or sale of all or part of Loto8's business, your personal data may be transferred to the acquiring entity as part of that transaction. You will be notified of any such transfer and any material changes to this Policy that result from it.
Loto8 may share your personal data with other third parties where you have given your explicit prior consent to such sharing. You may withdraw this consent at any time by contacting our Data Protection Officer.
Loto8 retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulation. The following general retention periods apply:
Upon expiry of the applicable retention period, Loto8 will securely delete or anonymize your personal data in accordance with its data disposal procedures. Where deletion is not immediately possible due to technical constraints, the data will be isolated and protected from further processing until deletion can be completed.
Loto8 implements a comprehensive set of technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:
While Loto8 takes all reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for notifying Loto8 immediately if you suspect any unauthorized access to your account.
Loto8 uses cookies and similar tracking technologies on the Platform to enhance your user experience, maintain your session, and collect analytics data. The following types of cookies are used:
These cookies are essential for the Platform to function correctly. They enable core features such as user authentication, session management, and security. These cookies cannot be disabled without impairing the functionality of the Platform.
These cookies remember your preferences and settings — such as your preferred language, display settings, and responsible gaming tool configurations — to provide a more personalized experience on the Platform.
Loto8 uses analytics cookies to collect aggregated, anonymized data about how players use the Platform. This data helps us understand which features are most used, identify technical issues, and improve the overall Platform experience. Analytics data is not used to identify individual players.
You can manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. For strictly necessary cookies, no opt-out is available as they are required for the Platform to operate.
Under the Data Privacy Act of 2012 (RA 10173), you have the following rights in relation to your personal data held by Loto8. To exercise any of these rights, please contact our Data Protection Officer using the details in Section 14.
Loto8 will respond to all data privacy rights requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further thirty (30) days, with prior notice to you. Loto8 reserves the right to verify your identity before processing any data rights request.
The Loto8 Platform is strictly intended for individuals who are 21 years of age or older. Loto8 does not knowingly collect personal data from individuals under the age of 21. The 21+ age requirement is consistent with Philippine regulations governing casino-style and online gaming activities.
All players are required to verify their age during the KYC process by submitting a valid government-issued identification document. Any account found to belong to a player under the age of 21 will be immediately suspended, all associated personal data will be securely deleted (except where retention is required by law), and any deposits made will be returned to the original payment source.
If you believe that a minor has registered an account on the Loto8 Platform, please contact our support team immediately so that we can take appropriate action.
Some of Loto8's service providers and infrastructure partners may be located outside the Philippines. Where your personal data is transferred to a country outside the Philippines, Loto8 ensures that appropriate safeguards are in place to protect your data in accordance with the Data Privacy Act of 2012 and NPC regulations on cross-border data transfers.
Such safeguards may include contractual data processing agreements incorporating standard data protection clauses approved by the NPC, or transfers to countries that have been assessed as providing an adequate level of data protection. Loto8 will not transfer your personal data to a third country unless it is satisfied that adequate protections are in place.
For more information about the safeguards applicable to any specific cross-border transfer of your personal data, please contact our Data Protection Officer.
Loto8 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or Platform features. When material changes are made, Loto8 will notify registered players via the email address associated with their account and will update the "Effective Date" at the top of this page.
We encourage you to review this Policy periodically to stay informed about how Loto8 protects your personal data. Your continued use of the Platform following the publication of an updated Policy constitutes your acceptance of the changes. If you do not agree with the updated Policy, you must cease using the Platform and close your account.
Loto8 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Policy. If you have any questions, concerns, or requests relating to your personal data or this Policy, please contact our DPO using the details below.
When submitting a data privacy request, please include your registered account username, a clear description of your request or concern, and any relevant reference numbers. This will help our DPO process your request as efficiently as possible.
You also have the right to lodge a complaint directly with the National Privacy Commission (NPC) of the Philippines if you believe your data privacy rights have been violated. The NPC is the government body responsible for administering and enforcing the Data Privacy Act of 2012.
A quick look at the key privacy commitments Loto8 makes to every player on the Platform.
Every deposit, withdrawal, and login on Loto8 is protected by SSL/TLS encryption. Your financial data and personal information are never transmitted in plain text, keeping your account secure at all times.
Loto8 does not sell, rent, or trade your personal information to advertisers or data brokers. Your data is used solely to operate the Platform, comply with Philippine law, and improve your gaming experience.
Under the Data Privacy Act of 2012, you have the right to access, correct, and request deletion of your personal data. Submit a request to our DPO and we will respond within 30 days — no runaround, no delays.
Loto8's data practices are designed to comply with the Data Privacy Act of 2012 (Republic Act No. 10173) and the regulations of the National Privacy Commission. Your rights as a Filipino data subject are fully respected.
Loto8 verifies the identity and age of every player before allowing real-money gaming. The 21+ age requirement is strictly enforced. No minor's data is knowingly collected or retained on the Platform.
Loto8 retains your data only as long as legally required. Once the retention period expires, your data is securely deleted or anonymized. You can request early deletion of non-legally-required data at any time.
Now that you know how Loto8 handles your personal data, register your account and start playing. Instant GCash and PayMaya deposits, real PHP prizes, certified fair games, and a privacy-first platform built for Filipino players. Must be 21 years or older.
By registering, you confirm you are 21 years of age or older and agree to the Loto8 Privacy Policy and Terms & Conditions. Play responsibly within your means.