Version 2.0 · Last updated: 6 November 2026
1. About this policy
This policy explains how Clobet Limited, trading as Lottofy (“we”, “us”), uses cookies and similar technologies on www.lottofy.co.uk and its subdomains. It says what each one does, how long it lasts and how you can control it. Read it with our Privacy Policy, which explains how we use your personal information and what your rights are.
Clobet Limited (company C-90546) is responsible for these technologies. Our registered office is at Junction Business Centre, 1st Floor, Sqaq Lourdes, St Giljan, SWQ 3334, Malta, and our UK address for correspondence is 4th Floor, 95 Chancery Lane, London, WC2A 1DT. We are licensed and regulated in Great Britain by the Gambling Commission under licence number 100831, and in Malta by the Malta Gaming Authority under licence number MGA/B2C/762/2019. You can contact our Data Protection Officer at privacy@lottofy.com.
We follow the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025. Because we are established in Malta, the EU General Data Protection Regulation and Maltese law also apply.
2. What we mean by cookies
A cookie is a small text file that a website saves in your browser, so it can recognise your device or remember information between pages and visits. This policy also covers technologies that work in a similar way:
browser storage (local storage, session storage and IndexedDB), which keeps information in your browser;
scripts that read technical details of your browser or device, such as our fraud-prevention check;
small images (pixels) and tracked links in our marketing emails.
In this policy we call all of them “cookies”. First-party cookies are set by us on lottofy.co.uk; third-party cookies are set by another company’s website. Session cookies disappear when you close your browser or tab. The others last for the time shown below or until you delete them.
3. Your choices
The first time you visit, a banner asks whether we may use optional cookies for analytics and for marketing. Nothing optional is used until you choose. “Accept” and “Reject” are equally easy, and “Customise” lets you choose each category. Rejecting does not stop you from using the site, opening an account or playing.
You can change your mind at any time with the “Cookie settings” button at the bottom of every page. Withdrawing consent is as easy as giving it and takes effect straight away: the tools stop using cookies from that moment. Cookies that other companies have already saved stay in your browser until they expire or you delete them.
If you are signed in, or when you open an account, we also record your marketing choice and when you made it on our servers, so that we can show what you agreed to.
We remember your choice for 12 months and then ask again. We also ask again if we add a new kind of optional cookie or change how we use one. Your choice is saved in your browser, so it only applies to that browser on that device. If you delete your cookies or use another device, we ask again.
You can also block or delete cookies in your browser settings: Chrome, Firefox, Safari, Edge. If you block strictly necessary cookies, parts of the site will stop working, such as signing in.
4. Strictly necessary cookies
These cookies make the site work and keep it secure and lawful. The law allows them without your consent, so they cannot be switched off in Cookie settings. They let us:
keep you signed in and protect your account, including two-step verification;
check where you are connecting from, because we may only offer our services in the United Kingdom;
detect fraud, money laundering and misuse of accounts, as our licence requires;
keep your basket, your sign-up progress and the invitations from friends that you follow;
remember your language, currency and cookie choices;
show live updates such as your balance and results, keep your support chat going, and recover when a page fails.
Our cookies
Name | What it does | How long |
__Host-hlc_auth_token | Keeps you signed in. | 30 days |
__Host-hlc_auth_pending | Your sign-in while you complete two-step verification. | 30 minutes |
hlc_lvdata | Remembers this browser as trusted after you complete two-step verification, so we do not ask for a code every time you sign in. | 15 days |
hlc_consent | Saves your cookie choices. | 12 months |
hlc_cookie_consent | Older version of hlc_consent. We delete it the next time you choose. | Until your next choice |
hlc_country | The country you are connecting from, so we only show what we may offer there. | 12 months |
hlc_locale | Your language. | 12 months |
hlc_lang_hint | Notes that you have picked a language, so we stop suggesting another one. | 12 months |
hlc_currency | The currency you chose for prices. | 12 months |
hlc_account_currency | Your account’s currency while you are signed in. | 24 hours |
hlc_ref | The code in a friend’s invitation link that you followed, so the invitation can be completed when you sign up or join the group. | 7 days |
hlc_invite | A group invitation you have not accepted yet. | 7 days |
Our browser storage
Name | What it does | How long |
hlc_guest_id | Identifies your basket before you sign in. | Until you clear your browser data |
hlc_chat_guest_id | Lets you carry on a support chat before you sign in. It is used only for the chat. | 30 days |
lotto-user-storage | Basic details of your account (name, username, email address, picture, language and currency), so pages show correctly when you reload. | Until you sign out |
hlc_referral_by, hlc_referral_by_ts, hlc_referral_src, hlc_pending_invite, hlc_pending_invite_ts | The friend or group invitation you followed. | 7 days |
hlc_locale_explicit, hlc_locale_synced | The language you picked and whether it is saved in your account. | 1 hour; until you clear your browser data |
pusherTransportTLS, pusherTransportNonTLS | Settings for the live-updates connection. | Until you clear your browser data |
lotto-promos-seen, account_setup, account_setup_skipped, account_setup_review, multiples_modal_last_shown, multiples_modal_suppressed_until, hlc_referral_rejected_seen | What you have already seen or done on the site: promotions viewed, account set-up steps, tips on the ticket and invitation notices. | Until you clear your browser data |
hlc_ad_consent_synced | Notes which of your marketing choices has already been recorded on our servers, so that it is only sent once. | Until you clear your browser data |
tl_bank_signup, tl_bank_signup_refused, tl_pending_payments | An account opening through your bank, or a payment from your bank account (TrueLayer), that has not finished yet, and whether your bank sign-up was refused. | Until it finishes or you clear your browser data |
lotto-identity-document-types-catalog-v3 | A copy of the identity documents we accept, so the verification screen loads faster. | Until you clear your browser data |
pending_auth_token, pending_auth_email, code_resend_cooldown_until, phone_verify_cooldown_until, phone_verify_destination (session storage) | Your sign-in while you type a verification code, and how long to wait before asking for a new code. | Until you close the tab |
lotto-registration-storage, tl_bank_signup_form (session storage) | Your progress on the sign-up form, including sign-up through your bank. It never holds your password. | Until you close the tab |
reality_check_timer, bets-history-state, bets-days:*, hlc_cart_promo_removed, cart_pending_promo_code, hlc_account_locale_redirect, hlc_referral_nudge_*, chunk-reload-*, tl_sdk_reload_suggested (session storage) | Reality-check reminders, what is shown on screen for your tickets, basket and notices, and whether the bank payment window needs reloading. | Until you close the tab |
Security and fraud prevention by other companies
Provider | What it does | Cookies |
SEON Technologies Kft. (EU) | When you sign in (including two-step verification), sign up, deposit, withdraw or pay for your basket, its script reads technical details of your browser and device to create a device signature, and keeps a random identifier in your browser so that it can recognise it again. We send them to SEON to detect fraud, multiple accounts and account takeover. The script also contacts SEON’s servers at seondnsresolve.com. | f3k2kqs7xc (cookie, 12 months), inersc2a2k (local storage) and ytkufm9oaz (IndexedDB, until you clear your browser data). The names may change when SEON updates its script. |
Cloudflare, Inc. | Protects the site from attacks. Its Turnstile check tells people from bots on sign-in, sign-up (including through your bank), password reset, our contact form and the location notice. It runs in a frame from challenges.cloudflare.com. | Turnstile sets none on our site. Only if Cloudflare has to show you a security challenge does it set cf_clearance (30 minutes by default). |
Error monitoring (our own Sentry server) | Records technical errors so we can fix them, with your user ID if you are signed in. | None |
When you use a feature that needs another company
These load only when you use the feature, because the service you asked for cannot work without them. They follow the provider’s own cookie policy.
Payments: the provider handling your payment, such as Nuvei for cards or TrueLayer for payments from your bank account (and for opening your account through your bank), and your bank’s own security check.
Identity verification: our verification providers, Didit or Persona. Didit’s check opens inside our page from verify.lottofy.co.uk. Each provider may use its own cookies to complete the check.
Casino games, where available: the game studio’s own player, shown in a frame. The frame cannot read our cookies or browser storage; the studio may use its own cookies to run the game.
5. Analytics cookies (only with your consent)
We use Google Analytics to count visits and see how the site is used: which pages people open, how they reach them and where something goes wrong. That helps us improve the site. It gives us statistics. We do not send Google your name, email address or account details, and Google signals and advertising features are turned off.
Name | What it does | How long |
_ga | Tells one browser from another. | 2 years |
_ga_QXSK54C3QX | Keeps track of your visit. | 2 years |
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC in the United States may also process the information (see section 8). We keep analytics data for 14 months. More information: how Google uses information from sites that use its services.
If you reject analytics, Google Analytics is not loaded. If you withdraw consent later, it stops using cookies straight away.
6. Marketing cookies (only with your consent)
Campaign and partner attribution. When you reach us through an advert, a campaign link or one of our partners (affiliates), we remember where you came from. That tells us which campaigns work and lets us pay the partner who introduced you. We keep the page that sent you, the page you landed on and the campaign tags in the link (such as utm_source or utm_campaign). We also keep the click identifiers that Google, Microsoft and Meta add to their adverts (gclid, gbraid, wbraid, msclkid, fbclid), partner codes and your browser type. We keep them in your browser storage and send them to our servers with a random visitor identifier and, if you open an account within 30 days, we link them to it. Partners never receive your name, contact details or gambling history: they get pseudonymised or aggregated figures to work out their commission.
If you do not accept marketing cookies, we keep and send none of this. A partner or promo code that you type in yourself when you sign up still counts. If you withdraw consent, we delete these items from your browser straight away.
Name | What it does | How long |
hlc_attribution_data | The campaign or partner details from the link you arrived through. | 30 days |
hlc_partner_code | A partner code from the link, used if you sign up. Deleted when you open your account. | 30 days |
hlc_visitor_id, hlc_visitor_id_ts | A random identifier for your visit and when it was created, so we can link the visit to your account if you sign up. | 30 days |
Advertising. We do not use advertising cookies or pixels on this site today. If we start measuring our adverts with platforms such as Google or Meta, we will describe it here and ask you first. With your consent, our servers would then tell the platform when someone who clicked one of our adverts opens an account or makes a first deposit, and its amount. We never place advertising scripts on our safer gambling, complaints, account, payment or verification pages. Wherever we can, we exclude customers who have self-excluded, including through GAMSTOP.
7. Our emails
We only send marketing emails if you agreed to receive marketing by email. They contain a tiny image and tracked links that tell us whether the email was opened and which links were clicked, so we can send fewer messages that are not useful. Service emails (about your account, payments, verification and safer gambling) do not contain them. To stop it, unsubscribe from marketing emails or set your email app not to load images automatically.
8. Transfers outside the United Kingdom
Malta and the European Economic Area are covered by UK adequacy arrangements. Some providers above are based in the United States: Google LLC, Cloudflare, Inc. and Persona Identities, Inc. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on that certification. Otherwise we use the UK International Data Transfer Agreement or the UK Addendum to the standard contractual clauses. Section 11 of our Privacy Policy explains this in more detail.
9. Changes and contact
We update this policy when we change the technologies we use, and we change the date at the top. If we add a new kind of optional cookie, we ask for your consent again. For any question, write to privacy@lottofy.com. You can also complain to the Information Commissioner’s Office (ico.org.uk/make-a-complaint).