1. Who we are and about this policy
This Privacy Policy explains how Clobet Limited, trading as Lottofy (“Clobet”, “Lottofy”, “we”, “us” or “our”), collects, uses, shares and protects your personal information when you visit www.lottofy.co.uk and its related subdomains, use our UK-facing services or applications, open or manage an account, or contact us. It also explains your choices and rights.
Clobet Limited is the controller responsible for the personal information described in this policy. We are incorporated in Malta under company registration number C-90546, with our registered office at Junction Business Centre 1st Floor, Sqaq Lourdes, St Giljan, SWQ 3334, Malta. We are licensed and regulated in Great Britain by the Gambling Commission under licence number 100831, and in Malta by the Malta Gaming Authority under licence number MGA/B2C/762/2019. Our UK postal address for correspondence is 4th Floor, 95 Chancery Lane, London, WC2A 1DT, United Kingdom.
You can contact us about your personal information, exercise your rights or make a privacy complaint by emailing privacy@lottofy.com or writing to “Privacy Enquiries, Clobet Limited” at our registered office.
This policy concerns customers, prospective customers and visitors. Separate notices apply to recruitment and employment. It should be read alongside our Terms and Conditions and the cookie information described in section 9. It does not replace those documents or restrict your statutory rights.
We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025. Because Clobet is established in Malta, our processing is also subject to the EU General Data Protection Regulation (EU) 2016/679 and the Maltese Data Protection Act (Chapter 586 of the Laws of Malta). Where both regimes apply, we comply with each of them. Our gambling regulatory obligations in Great Britain and Malta also affect how we use and retain information.
Using our website or accepting our Terms and Conditions does not, by itself, constitute consent to marketing, optional cookies or every use of personal information described here.
2. Personal information we collect
The information we collect depends on your relationship with us and the services you use. It may include:
Identity and contact information: your name, date of birth, address, email address, telephone number and, where required for verification, nationality and identity document details.
Account information: your username, account identifier, authentication information, registration details, preferences, account status and records of changes to your account.
Verification and financial information: identity documents, proof of address, payment ownership information, occupation and employment details, income, source of funds or wealth, and supporting documents where needed for our checks. We may also receive verification outcomes, relevant financial vulnerability information, sanctions or politically exposed person screening results and relevant adverse media.
Payment and transaction information: payment method details, bank details where needed, deposits, withdrawals, refunds, stakes, purchases, prizes, payment references and transaction history. Payment providers may also process payment information directly. We do not retain your card security code after authorisation.
Gambling and safer gambling information: the products and games you use, bets and ticket orders, results, session history, spend, deposits and losses, limits, time-outs, self-exclusions, risk indicators and records of customer interactions and protective measures.
Communications: enquiries, emails, live chat messages, complaints, dispute records and other information you provide when communicating with us. If a call is recorded, we will inform you at the time and explain why.
Technical and usage information: IP address, device and browser information, operating system, access times, login and logout records, pages visited, interactions with our services, security logs and identifiers collected through permitted cookies or similar technologies.
Marketing information: your product and channel preferences, consent records, withdrawals of consent and, where lawfully collected, information about your response to communications.
Referral and promotional information: the affiliate, partner or campaign through which you came to us, any promotional codes used, and bonuses or offers made available to you.
Some documents may contain information we do not need. Please do not send unrelated sensitive information. Where appropriate, we will explain which parts of a document are required and which may be redacted.
Health information, certain biometric information and information about criminal offences require additional protection. Section 6 explains how we handle these categories.
3. Where your information comes from
We collect information directly from you when you register, use our services, make payments, complete checks, set preferences or contact us. We also collect technical and activity information through our systems and, where permitted, cookies and similar technologies.
Where necessary for the purposes in this policy, we receive information from:
Identity and age verification providers, payment providers and banks;
Fraud prevention services, screening providers and credit reference agencies used for relevant verification or financial vulnerability checks;
GAMSTOP and other applicable self-exclusion arrangements;
Game and platform providers involved in delivering or reconciling your activity;
Regulators, law enforcement authorities, dispute resolution bodies and professional advisers; and
Public sources, such as sanctions lists, official registers, public insolvency or judgment information, and relevant media reports, where a check is necessary and lawful.
Where an agency conducts a check, it may retain a record of the search and act as a separate controller. We will provide further information about the relevant agency and check where required. We do not treat permission to conduct one check as permission for unrelated searches.
If another person provides your information, we assess whether we have a lawful basis to use it. Their assurance alone does not replace our obligations. Where required, we provide you with privacy information within one month, or earlier if we first contact you or disclose your information before then.
4. Why we use your information and our lawful bases
We identify the lawful basis that applies to each activity. A purpose may involve separate activities with different bases; this does not mean that all bases apply indiscriminately to all your information.
Opening and administering your account; providing services; processing bets or ticket orders, deposits, withdrawals, refunds and prizes; and responding to service requests: necessary to enter into or perform our contract with you. This uses the relevant identity, contact, account, transaction and service information.
Verifying age, identity and eligibility; carrying out required anti-money laundering, sanctions and source-of-funds checks; keeping regulatory records; and making mandatory reports: necessary to comply with applicable legal obligations, including the Gambling Act 2005, applicable licence conditions and codes, the Proceeds of Crime Act 2002 and, where applicable to the activity, the Money Laundering Regulations 2017. This uses relevant identity, verification, financial, transaction and activity information.
Identifying gambling-related harm, conducting required customer interactions, enforcing limits and self-exclusions, and checking GAMSTOP: necessary to comply with applicable gambling regulatory obligations. Additional protective activity beyond those requirements may be based on our legitimate interests in protecting customers and operating safe services, following an assessment of its necessity and impact on your rights. We use relevant identity, gambling, financial and interaction information; additional conditions apply to sensitive information.
Detecting fraud, account misuse, collusion and security threats: compliance with legal obligations where a specific requirement applies; otherwise, our legitimate interests in protecting customers, payments and the integrity and security of our services. We use relevant identity, technical, transaction, account and activity information.
Handling complaints, resolving disputes and establishing or defending legal claims: performance of our contract for service complaints; compliance with statutory or regulatory complaint-handling requirements; and our legitimate interests in resolving disputes and protecting legal rights for related claims work. We use information relevant to the matter concerned.
Maintaining and improving our services, troubleshooting and carrying out proportionate internal analysis: our legitimate interests in running reliable services and understanding their performance. We minimise the information used and use anonymous information where practicable. Consent is obtained where required for the collection technology or the particular use.
Sending direct marketing and tailoring promotional communications to your selected interests: your consent, in accordance with your product and channel choices. We use relevant contact, preference and, where explained in the consent request, activity information.
Keeping accounting records and responding to lawful regulatory or tax requests: compliance with applicable legal obligations. We use relevant identity, transaction and accounting information.
Maintaining evidence of permissions and respecting objections or opt-outs: compliance with our data protection and marketing obligations and our legitimate interests in demonstrating compliance and preventing unwanted contact.
Attributing registrations to the affiliates or partners who referred you and calculating their commission: our legitimate interests in operating and paying for our referral arrangements. We use your referral identifier, registration date and pseudonymised or aggregated activity information. We do not share your name, contact details or detailed gambling history with affiliates for this purpose.
Delivering, measuring and suppressing online advertising, including through advertising and social media platforms: your consent for the relevant cookies or similar technologies and, where we use contact details for this purpose, for that use. We exclude customers who have self-excluded or opted out of marketing from targeted advertising where technically possible.
Business restructuring or a proposed sale: our legitimate interests in evaluating and completing a legitimate transaction, subject to confidentiality, minimisation and the safeguards in section 10.
When relying on legitimate interests, we assess whether the processing is necessary and whether your interests or fundamental rights override those interests. You can object as explained in section 14. A commercial benefit alone does not justify processing that unfairly affects you.
If we intend to use your information for a new purpose, we will assess whether this is permitted and provide the required information before starting. Where a new use needs your consent, we will ask for it separately.
5. Information you need to provide
Certain information is necessary to enter into or perform our contract, verify your age and identity, comply with regulatory requirements, assess relevant risks or process a payment. We will indicate mandatory information when collecting it and explain additional requests where legally permitted.
If you do not provide required information, or it cannot be verified, we may be unable to open your account, provide a service or complete a transaction. We may need to restrict or close an account in accordance with the law and our Terms and Conditions. We will not use unnecessary requests for information to obstruct the exercise of your rights or lawful withdrawals.
Optional marketing consent is not a condition of opening an account or using our services. Please keep your information accurate and tell us when it changes.
6. Sensitive information and criminal offence information
You may disclose health or other sensitive information when asking for support or discussing gambling-related harm. We collect and retain only what is necessary for the relevant support, protection or legal purpose, and restrict access to staff who need it.
In addition to a lawful basis under Article 6 UK GDPR, processing special category information requires a condition under Article 9. Depending on the circumstances, we rely on: your explicit consent (Article 9(2)(a)); necessity for the establishment, exercise or defence of legal claims (Article 9(2)(f)); or one of the following substantial public interest conditions in Part 2 of Schedule 1 to the Data Protection Act 2018: preventing or detecting unlawful acts (paragraph 10), regulatory requirements (paragraph 12), preventing fraud (paragraph 14) or safeguarding of individuals at risk (paragraph 18). We rely on a condition only where all of its statutory requirements are met, and we maintain the appropriate policy document required by the Data Protection Act 2018. Gambling regulation alone does not automatically satisfy Article 9.
We explain the applicable condition when requesting this information or through an appropriate supplementary notice. If relying on explicit consent, we explain the purpose and how to withdraw it. Withdrawal does not affect earlier lawful processing or processing that is independently justified by another applicable legal requirement and condition.
Criminal conviction, offence and allegation information is treated separately from special category information. We process it only with a lawful basis and the authorisation required by Article 10 UK GDPR and the Data Protection Act 2018, for example under an applicable condition for preventing or detecting unlawful acts or meeting qualifying regulatory requirements. We apply the safeguards and policy documentation required for the condition used.
If a verification process involves biometric identification, we will explain that processing, the provider’s role and the applicable legal conditions before it takes place. An ordinary identity photograph is not automatically biometric information used for unique identification.
We do not use health or vulnerability information to target promotional offers or encourage further gambling.
7. Safer gambling, self-exclusion and verification
We use relevant account, gambling, transaction and interaction information to meet our customer protection obligations. Indicators may include changes in spending, deposits, losses, session length or frequency, failed payments, self-imposed limits and information you provide. An indicator does not necessarily mean that you have a gambling problem.
Checks and reviews may lead to a request for information, contact from our team, limits, removal of marketing or incentives, or suspension or closure of an account, as appropriate. We seek to use information proportionately and consider relevant context.
We exchange the identity and account information necessary to check and give effect to GAMSTOP and applicable self-exclusion requirements. GAMSTOP processes information under its own privacy notice, available through www.gamstop.co.uk. We also retain appropriate internal exclusion records to help prevent excluded customers from reopening accounts or receiving prohibited marketing.
We may be legally prevented from explaining certain financial crime checks or reports. This does not remove our obligation to use the information lawfully.
8. Marketing and your choices
We send direct marketing only where you have opted in to the relevant products and communication channels. Choices are offered separately, are off by default and can be updated. Categories cover the products we offer, including casino and betting, with lottery betting identified within the relevant betting category. Any other product category will be described clearly where you make your choice.
You can choose the applicable communication channels, such as email, SMS or telephone, independently. Agreeing to one product or channel does not authorise marketing for another. We do not rely solely on an existing customer relationship to send gambling marketing contrary to your preferences.
You can withdraw consent or object to direct marketing at any time, without charge, through your account preferences, the unsubscribe facility in a message, or privacy@lottofy.com. We will stop the relevant marketing and associated marketing profiling. Withdrawing consent does not affect the lawfulness of marketing sent before withdrawal.
We may retain the minimum information needed on a suppression list so that your choice continues to be respected. Self-exclusion and other regulatory protections override marketing permissions where required.
Essential service messages, including transaction confirmations, security alerts, required verification requests and safer gambling communications, are separate from marketing. You may continue to receive these where necessary even if you decline marketing. We will not use a service message to circumvent your choices.
We do not sell your personal information. We will not disclose your contact details to another organisation for its own marketing without a separate lawful basis and any consent required by law.
9. Cookies and similar technologies
Our services use cookies and similar technologies for purposes such as authentication, security and remembering choices. We also use optional technologies where you have given the required permission. Such technologies may involve device information and online identifiers.
Strictly necessary technologies may operate without consent where the legal exemption applies. Our approach is to obtain consent for optional analytics, personalisation and advertising technologies before activating them. Refusing optional technologies does not prevent you from using the core service.
You can review or change your choices through the website’s cookie settings. Withdrawal is as easy as giving consent. Browser controls may also help, although blocking essential cookies can affect service functionality.
Our Cookie Policy and consent interface provide the current technologies, purposes, providers, durations and available controls, including information about third-party access.
10. Who we share your information with
We disclose information only where necessary for the stated purpose and supported by an appropriate lawful basis. Recipients may include:
Service providers: hosting and infrastructure, account and gaming platforms, payment processing, identity verification, screening, security, customer support and communication providers.
Product and fulfilment providers: gaming suppliers and, where required for a selected ticket purchase or prize claim, ticket fulfilment providers, lottery operators or prize settlement and indemnity providers. We disclose only the information needed for the particular service or claim.
Affiliate, marketing and advertising partners: affiliates who referred you, who receive only the referral identifier and pseudonymised or aggregated information needed to calculate commission; and, where you have given the required consent, advertising and social media platforms, which may receive online identifiers or hashed contact details to deliver, measure or suppress advertising.
Verification and protection organisations: fraud prevention agencies, relevant credit reference agencies, GAMSTOP and other applicable self-exclusion services.
Public authorities: the Gambling Commission, competent financial intelligence, law enforcement, tax and other authorities, where disclosure is required or otherwise lawfully justified. A request does not automatically entitle an authority to unrestricted access.
Professional advisers and dispute bodies: lawyers, auditors, insurers and approved alternative dispute resolution bodies where necessary for advice, audit, a claim or a dispute.
Group companies: only where they provide a relevant service or carry out a specific lawful administrative or compliance function. Group membership does not grant unrestricted access or marketing permission.
Parties to a business transaction: prospective or actual buyers, investors and their advisers, where necessary for a proposed restructuring, financing or transfer, subject to confidentiality and proportionate disclosure. We will provide further information where the identity of the controller or the use of your information changes.
Providers acting on our behalf must process information under appropriate contractual instructions, protect it and limit its use to the agreed purpose. Some recipients, such as banks, regulators and self-exclusion organisations, act as independent controllers and have their own privacy notices. Where a joint-controller arrangement applies, we will make the required information about that arrangement available.
11. International processing and transfers
Clobet is established in Malta, and your information is processed there in connection with our services. Suppliers may also process information in other countries, including through overseas support or remote access.
Where a disclosure is a restricted transfer under UK data protection law, we use an appropriate transfer mechanism. Malta and other EEA countries are currently covered by UK adequacy arrangements. Where the recipient and processing fall within an applicable UK adequacy arrangement, we may rely on it.
For a restricted transfer not covered by adequacy, we use appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and assess the protection provided in the destination. We implement supplementary measures where needed. EU standard contractual clauses alone do not replace the required UK mechanism.
We rely on exceptions for specific transfers only where the legal conditions are met; acceptance of this policy is not consent to unrestricted overseas transfers.
You can contact privacy@lottofy.com for information about relevant destinations and to request a copy or explanation of the applicable safeguards. We may redact commercially confidential information or information concerning other people while still explaining the protection provided.
12. How long we keep your information
We retain personal information only for as long as necessary for the purpose concerned, taking account of applicable legal requirements, regulatory obligations, exclusions, disputes and limitation periods. Closing an account does not necessarily require immediate deletion of all records.
Core account, service and transaction records: generally for the duration of your account and up to six years after closure or the relevant transaction, as appropriate, where necessary for accounting, regulatory evidence or legal claims. This is not a requirement to keep every item of information for six years; unnecessary information is removed sooner.
Records subject to the UK Money Laundering Regulations 2017: normally for five years from the end of the business relationship or completion of the relevant occasional transaction, subject to the applicable statutory rules and exceptions. We delete information at the end of the applicable period unless a specific lawful ground permits continued retention. There is no automatic ten-year retention period for every customer record.
Self-exclusion and safer gambling records: for the exclusion or protection period and any further period necessary to enforce restrictions, prevent improper re-registration and demonstrate compliance. We take account of the type and duration of the exclusion, ongoing restrictions, applicable regulatory rules and relevant claims. Where a restriction continues indefinitely, the minimum record needed to enforce it may also need to be retained.
Uncompleted registrations or referral details that do not lead to an account: normally no longer than three months, unless a specific security, fraud prevention or legal reason requires a limited record for longer.
Customer communications and complaints: for as long as needed to deal with the issue and, where necessary, the relevant regulatory or legal-claims period. Material records relating to an account dispute may form part of the core account record; routine enquiries are removed sooner when no longer needed.
Marketing information: while the relevant permission remains valid and the information is needed for the stated purpose. We keep limited evidence of consent and withdrawal for compliance purposes, and suppression information for as long as needed to prevent unwanted marketing.
Technical records and cookies: according to their security or operational purpose and the durations specified in the cookie information. Short-lived operational information is not retained for the full account-record period merely because it relates to a customer.
Where an investigation, litigation hold or another specific legal requirement requires longer retention, we retain only the relevant information, restrict its use and review the need periodically. A separate record kept for a different lawful purpose does not justify continued use of all underlying documents.
At the end of the applicable period, information is securely deleted or anonymised. Backup copies are removed through the normal protected backup cycle and are not used for ordinary business purposes while awaiting deletion. You can request further information about the retention criteria applicable to your records.
13. Profiling and automated decisions
Our systems process information automatically to operate accounts, complete transactions and support checks. Profiling occurs where information is used to evaluate personal aspects, such as interests or risk; not every automated calculation is profiling.
Where we analyse activity for safer gambling, security or permitted personalisation, the relevant information, purpose and lawful basis are described in sections 2, 4, 7 and 8. You can object to legitimate-interest profiling and can stop marketing profiling by withdrawing consent or objecting to marketing.
We currently make decisions based solely on automated processing in the following situations:
Electronic age and identity verification at registration: if your details cannot be matched, your account will not be fully opened until you provide documents, which are reviewed by our team.
Fraud and payment-risk rules, which may temporarily block a deposit, withdrawal or transaction.
Safer gambling controls that automatically apply restrictions when defined risk thresholds are reached.
These systems compare the information you provide and your account activity against predefined rules and risk models, for example mismatches in identity data, unusual payment patterns or rapid increases in deposits or losses. The possible consequences include delayed account opening, a blocked transaction or a temporary restriction on your account.
Where a decision is made solely by automated means and has legal or similarly significant effects, we provide the information and safeguards required by UK law. These include an opportunity to make representations, obtain human intervention and contest the decision. You can request this through privacy@lottofy.com. A reviewer must have the authority and information needed to reconsider the outcome. Additional restrictions apply where special category information is involved.
14. Your rights and how to exercise them
Subject to the conditions and exceptions in UK data protection law, you have the following rights:
Access: ask whether we process your personal information and obtain a copy and related information. We normally respond without undue delay. When responding to an access request, we carry out reasonable and proportionate searches for your personal information, as permitted by UK data protection law.
Rectification: have inaccurate information corrected and incomplete information completed.
Erasure: request deletion where the legal conditions are met. This is not an absolute right; we may need to retain information for legal obligations, exclusions or legal claims.
Restriction: ask us to limit the use of information in specified circumstances, for example while a relevant accuracy dispute is examined.
Portability: receive information you have provided in a structured, commonly used, machine-readable format, and request transmission to another controller where technically feasible, when processing is automated and based on consent or contract.
Objection: object, on grounds relating to your situation, to processing based on legitimate interests. We will stop unless we demonstrate compelling overriding grounds or the processing is needed for legal claims. Your right to object to direct marketing, including related profiling, is absolute.
Withdrawal of consent: withdraw consent at any time, without affecting processing that was lawful before withdrawal.
Automated-decision safeguards: request the review and protections explained in section 13.
Complaint: raise a privacy complaint with us or the UK supervisory authority, as described in section 16.
Contact privacy@lottofy.com. You do not need to use legal terminology or a particular form. We will assist you in making a request.
We normally respond without undue delay and within one month. Where legally permitted because of complexity or the number of requests, we may extend by up to two further months, notifying you and explaining why within the initial period. If reasonably necessary, we may ask for proportionate information to confirm your identity or clarify an access request; any adjustment to the time limit will follow the applicable law and will be explained.
Requests are normally free. Where the law permits a reasonable fee or refusal, for example for a manifestly unfounded or excessive request, we will explain our decision and your complaint rights. We may need to protect other people’s information or apply a specific exemption, including where disclosure would prejudice prevention or detection of crime. We assess exemptions individually rather than applying a blanket restriction.
15. How we protect your information
We use technical and organisational measures appropriate to the risks, including access controls, secure transmission, staff confidentiality requirements, supplier controls and procedures for detecting and responding to incidents. Access is limited to authorised people who need the information for their work.
No system can guarantee absolute security. Please protect your login details, use a strong and unique password, keep your devices secure and notify us promptly if you suspect unauthorised access. We will never ask you to disclose your password.
If a personal data breach occurs, we assess it and notify the relevant authority and affected individuals where required by law.
16. Privacy complaints
If you are concerned about how we use your information, email privacy@lottofy.com or write to “Privacy Complaints, Clobet Limited” at our registered office. Please describe the issue and how we can contact you. We will help you make a complaint where assistance is needed.
We will acknowledge your complaint within 30 days, investigate appropriately without undue delay, keep you informed about progress and communicate the outcome and any steps taken. This complaint procedure is separate from the response deadlines for exercising your data protection rights.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection supervisory authority. Information about submitting a complaint and current contact details is available at ico.org.uk/make-a-complaint.
We encourage you to contact us first so that we can address the issue. This does not remove your right to approach the ICO or seek a judicial remedy. Privacy complaints are distinct from disputes about gambling transactions dealt with under our gambling complaints and dispute resolution procedure. Because our processing is also subject to the EU GDPR, you may also complain to the Information and Data Protection Commissioner in Malta (idpc.org.mt) or, if you live or work in the European Union, to the data protection supervisory authority in that country.
17. Children and other websites
Our gambling services are for people aged 18 or over. We do not knowingly permit children to open or use gambling accounts. If we discover an underage account, we take steps to prevent further use and handle the information in accordance with our legal obligations. We delete information that is no longer needed, while retaining only records necessary for matters such as investigation, compliance or preventing further unlawful access.
Our services may contain links to independent websites. Their privacy practices are governed by their own notices. This does not reduce our responsibility for information we disclose to them.
18. Changes to this policy
We review this policy when our practices or applicable requirements change. We will publish the current version and update the date. For material changes, we will take appropriate steps to draw them to your attention before they take effect where required. Where a change requires consent, we will obtain it; continued use of the service is not a substitute.
For any privacy question, contact privacy@lottofy.com.
Last updated: 6 October 2026