Privacy Policy
Last updated: 29 August 2026
LottoSwitch ("we", "us", "the Platform") is the data controller for personal data collected through lottoswitch.com and Operator storefronts hosted on the Platform. This policy complies with the Nigeria Data Protection Act 2023 (NDPA).
Privacy contact: privacy@lottoswitch.com
1. What we collect
| Category | Data | When |
|---|---|---|
| Identity & contact | Phone number, email address, display name | Playing a game, creating an account |
| Age & verification | Date of birth, NIN or BVN, verification status | Age gate at first play; identity verification before withdrawal |
| Financial | Bank name, account number, account name | Withdrawals, account-closure payouts |
| Transactions | Stakes, tickets, numbers picked, winnings, wallet ledger, payment references | Every transaction |
| Device & usage | IP address, device/browser identifiers, pages visited | Every visit |
| Operator data | Business name, KYB documents, founder identity, settlement accounts | Operator onboarding |
We do not store card numbers or payment instrument details — payments are processed by Flutterwave. Device-local ticket history for guests is stored on your device, not our servers.
2. Why we process it
| Purpose | Lawful basis (NDPA) |
|---|---|
| Providing games, tickets, wallets, payouts | Performance of a contract |
| Age and identity verification (NIN/BVN) | Legal obligation (MLPPA 2022; gaming regulations) |
| Withholding tax deduction and remittance | Legal obligation (tax law) |
| Fraud, money-laundering and underage-play prevention | Legal obligation and legitimate interest |
| Transaction records and audit | Legal obligation and legitimate interest |
| Product improvement and analytics | Legitimate interest |
| Marketing communications (if any) | Consent (withdrawable) |
3. Who we share it with
- Flutterwave — payment processing and payouts.
- Identity verification providers — NIN/BVN verification.
- Operators — limited ticket and contact data for games you play on their storefront.
- Regulators and tax authorities — NLRC, LSLGA, LIRS/FIRS, EFCC, NDPC — where required by law, including suspicious activity reports.
- Infrastructure processors — database and application hosting providers.
We do not sell personal data.
4. "Find my ticket" and phone-number privacy
Ticket lookup requires selecting the Operator first, then entering the phone number used to play. We do not expose ticket data across Operators, and we rate-limit lookups to prevent enumeration of phone numbers.
5. Retention
| Data | Retention |
|---|---|
| Transaction and wallet ledger records | 7 years (tax/AML record-keeping) |
| Identity verification records | 5 years after account closure |
| Account profile data | Until closure + 12 months |
| Device-local ticket history | On your device; clearing browser storage deletes it |
| Support/dispute records | 3 years |
6. Your rights
Under the NDPA you may: access your data; correct inaccuracies; request deletion (subject to legal retention duties); restrict or object to processing; request data portability; withdraw consent; and lodge a complaint with the Nigeria Data Protection Commission (NDPC).
Exercise rights via privacy@lottoswitch.com. We respond within 30 days.
7. Security
Row-level access controls on all financial tables; encrypted draw secrets; PIN-hashed transaction authorization; multi-factor authentication for Operator and admin accounts; separation between public and privileged database access.
8. Cookies
We use strictly necessary cookies (authentication, security, MFA device trust, referral attribution). We do not use advertising trackers.
9. Children
The Platform is strictly 18+. We do not knowingly collect data from minors. Accounts found to belong to minors are closed and handled per our Terms.