Privacy Policy

This Privacy Policy ("Policy") describes how Cartalotto ("we", "us", "our", "the Platform") collects, uses, stores, discloses, and protects the personal data of individuals ("you", "your", "User", "Player") who access or use the website located at https://cartalotto.cam and all associated services, features, and content.

Cartalotto is an online casino and sports betting platform serving players in Malaysia and permitted jurisdictions. We are committed to handling your personal data responsibly, transparently, and in accordance with applicable data protection laws and international privacy standards.

By registering an account on Cartalotto, accessing the Platform, or otherwise interacting with our services, you acknowledge that you have read this Policy and consent to the collection and processing of your personal data as described herein. This Policy should be read alongside our Terms & Conditions, which govern the overall use of the Platform.

The following terms have the meanings set out below throughout this Policy:

Cartalotto collects the following categories of personal data, depending on the nature of your interaction with the Platform:

3.1 Registration and Account Data

• Full legal name
• Date of birth (to verify the 21+ age requirement)
• Email address
• Mobile phone number
• Chosen username and encrypted password
• Country and city of residence (e.g., Kuala Lumpur, Penang, Johor Bahru, Shah Alam, Petaling Jaya)

3.2 Identity Verification (KYC) Data

• Copy of government-issued photo identification (Malaysian MyKad, Driver's Licence, or Passport)
• Proof of residential address (utility bill, bank statement, or official correspondence dated within the past 3 months)
• Selfie photograph with identity document
• Payment method verification documents where required

3.3 Financial Transaction Data

• Deposit and withdrawal records including amounts, timestamps, and payment method references
• Payment method identifiers (e-wallet account reference, bank account number suffix, or cryptocurrency wallet address — where applicable)
• Currency denomination (Malaysian Ringgit / MYR)

3.4 Gaming and Betting Activity Data

• Game session records (game type, start/end time, wager amounts, outcomes)
• Sports betting history (markets, odds, stake, and settlement data)
• Bonus claims and wagering progress
• VIP tier status and loyalty points balance

3.5 Technical and Device Data

• IP address and approximate geolocation
• Device type, operating system, and browser information
• Session identifiers and login timestamps
• Referring URL and page navigation data

3.6 Communication Data

• Live chat transcripts and support ticket correspondence
• Email communications sent to or received from Cartalotto
• Voluntary feedback and survey responses

Cartalotto collects personal data through the following channels:

• Directly from you — during account registration, KYC submission, deposit/withdrawal requests, support interactions, and when you update your profile settings.
• Automatically via the Platform — through cookies, server logs, and tracking technologies that record your technical interactions with the website (see Section 10 for details).
• From payment processors — when you make a deposit or withdrawal via Touch 'n Go eWallet, Boost, GrabPay, DuitNow, FPX (Maybank, CIMB, Public Bank Berhad, Hong Leong Bank), or USDT TRC20, relevant transaction confirmation data is shared with us by the payment provider.
• From identity verification providers — where we engage third-party KYC or anti-fraud service providers to assist with document verification, those providers may share verification outcome data with us.
• From fraud and compliance screening tools — automated systems may flag certain account activity for review based on behavioural risk signals.

Cartalotto processes your personal data under one or more of the following lawful bases, depending on the specific processing activity:

Cartalotto uses your personal data for the following purposes:

• Account Management: Creating, maintaining, and administering your registered Cartalotto account, including processing login authentication and account updates.
• Service Delivery: Processing your deposits and withdrawals, crediting winnings to your account wallet, and facilitating your use of all gaming and betting features on the Platform.
• Identity and Age Verification: Confirming that you meet the minimum age requirement of 21 years and verifying your identity as part of our KYC compliance programme.
• Fraud Prevention and Security: Monitoring account activity for signs of fraud, unauthorised access, collusion, money laundering, or other prohibited activities as defined in our Terms & Conditions.
• Regulatory Compliance: Meeting our anti-money laundering (AML) obligations, responding to lawful requests from regulatory or law enforcement authorities, and maintaining accurate records as required by applicable law.
• Responsible Gambling: Monitoring player activity to identify indicators of problem gambling behaviour, applying player-requested limits, processing self-exclusion requests, and providing appropriate interventions.
• Customer Support: Responding to your enquiries, resolving disputes, and providing technical assistance.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve Platform performance, user experience, and game selection — particularly to better serve Malaysian players.
• Marketing Communications: Sending you promotional offers, bonus notifications, and event alerts where you have consented to receive such communications. You may opt out at any time.

Cartalotto does not sell, rent, or otherwise transfer your personal data to third parties for their own commercial or marketing purposes. We may share your personal data only in the following limited circumstances:

• Payment Processing Partners: We share the minimum necessary transaction data with payment service providers (including e-wallet operators and banking partners) to facilitate the processing of your deposits and withdrawals.
• KYC and Identity Verification Providers: We engage specialist identity verification providers to assist with document authentication. These providers act as data processors under written agreements and are prohibited from using your KYC data for any purpose beyond the verification service.
• Fraud Prevention and Security Services: We may share account risk data with anti-fraud platforms and cybersecurity services to protect the Platform and its players.
• Regulatory and Law Enforcement Authorities: We will disclose personal data to competent authorities where required by law, court order, or regulatory directive — for example, in connection with AML investigations or lawful requests from Malaysian authorities.
• Auditors and Legal Advisers: Professional advisers engaged in the course of our business operations may access limited personal data subject to strict confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of Cartalotto's business, personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments.

Cartalotto retains your personal data for as long as is necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following general retention guidelines apply:

Following the expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents recovery or re-identification.

Subject to applicable law and the limitations described below, you have the following rights with respect to your personal data held by Cartalotto:

1. Right of Access: You may request a copy of the personal data we hold about you, together with information about how it is being processed. We will respond to verified access requests within 30 days.
2. Right to Rectification: If any personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected. You may update basic account information directly via your profile settings, or contact our support team for assistance with data you cannot update yourself.
3. Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (and no other lawful basis applies), or where processing is unlawful. Please note that we are required to retain certain data for minimum periods under AML and financial record-keeping obligations — erasure requests may be partially fulfilled where legal retention requirements apply.
4. Right to Restriction of Processing: You may request that we restrict the processing of your personal data in certain circumstances — for example, while you contest the accuracy of data we hold, or where processing is unlawful but you prefer restriction over deletion.
5. Right to Data Portability: Where processing is based on consent or contractual necessity, and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format.
6. Right to Object: You may object to processing based on our legitimate interests, including profiling. You may also withdraw consent to marketing communications at any time by contacting support or following the unsubscribe instructions in any marketing email.

To exercise any of the above rights, please contact our support team via live chat or by email. We will verify your identity before processing any rights request. We respond to all verified requests within 30 days; complex requests may take up to 60 days with notice to you.

Cartalotto uses cookies and similar tracking technologies (such as web beacons and local storage) to operate the Platform, improve user experience, and analyse aggregate usage patterns. We do not use cookies to build advertising profiles for third parties or to track your activity across unrelated websites.

Categories of cookies we use:

• Strictly Necessary Cookies: Essential for the Platform to function. These include session authentication tokens, security cookies, and load-balancing cookies. They cannot be disabled without affecting Platform functionality.
• Functional Cookies: Remember your preferences (such as language settings and game lobby layout) between sessions. These improve your experience but are not strictly required for core functionality.
• Analytics Cookies: Collect anonymised data about how users interact with the Platform — pages visited, session duration, error events — to help us improve performance and content. Data collected is aggregated and not attributable to individual users.
• Security and Fraud Prevention Cookies: Help us detect and prevent fraudulent activity, bot access, and account takeover attempts.

You may manage cookie preferences through your browser settings. Disabling strictly necessary cookies may impair your ability to log in or use the Platform. For functional and analytics cookies, disabling them will not prevent you from accessing the Platform but may affect certain preference-saving features.

Cartalotto implements a multi-layered approach to data security, including the following technical and organisational measures:

• Encryption in Transit: All communications between your device and our servers are protected by 256-bit SSL/TLS encryption. The padlock icon in your browser address bar confirms your connection to cartalotto.cam is encrypted.
• Encryption at Rest: Sensitive personal data — including KYC documents, financial records, and password hashes — is stored in encrypted form in access-controlled server environments.
• Access Controls: Internal access to personal data is restricted on a strict need-to-know basis. Staff with access to player data receive data protection training and are bound by confidentiality obligations.
• Penetration Testing: Our systems undergo periodic security assessments and penetration testing to identify and remediate potential vulnerabilities.
• Incident Response: We maintain a documented data breach response procedure. In the event of a breach affecting your personal data, we will notify affected players and relevant authorities within the timeframes required by applicable law.

While we implement industry-standard security measures, no online system is completely immune to risk. You are responsible for keeping your own account credentials secure. If you suspect unauthorised access to your account, please contact our support team immediately via live chat.

The Cartalotto platform does not contain links to third-party websites beyond those required for payment processing redirects (e.g., FPX bank portal redirects for Maybank, CIMB, Public Bank, or Hong Leong Connect). Where such redirects occur, you are being transferred to the relevant financial institution's own secure environment, which is governed by that institution's own privacy policy.

Cartalotto is not responsible for the privacy practices or content of any third-party website or service. We encourage you to review the privacy policies of any external websites you access.

The Cartalotto platform is strictly intended for adults aged 21 years and above. We do not knowingly collect, process, or retain personal data from individuals under the age of 21.

Age verification is conducted as part of the account registration and KYC process. Where we discover that personal data has been collected from an individual under 21, we will immediately terminate the relevant account and delete all associated personal data, subject to any legal obligation to retain records of the attempted underage registration.

If you believe that a minor has registered an account on Cartalotto, please notify us immediately via live chat or email so that we can take prompt action.

Cartalotto reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. When material changes are made, we will update the "Last updated" date at the top of this document and, where appropriate, notify registered players via email or an in-Platform notification.

Your continued use of the Cartalotto platform following the publication of an updated Policy constitutes your acceptance of the revised terms. We recommend reviewing this Policy periodically. The current version is always accessible at cartalotto.cam/privacy-policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact the Cartalotto data team:

We aim to acknowledge all privacy enquiries within 3 business days and to fully resolve data rights requests within 30 calendar days of identity verification. For complex requests, we may extend this period by up to an additional 30 days, in which case we will notify you in writing of the extension and the reason for it.