Privacy Policy

Last Updated: 21 July 2026

Welcome

MagicLotto respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use our website, services, and customer support channels. It is written to comply with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and the POPIA Regulations, as amended (including the amendments published on 17 April 2025).

Who We Are

Operator / Responsible Party: Reboot Internet Technology CC (trading as “MagicLotto”)
Registration Number: 2001/016173/23
Website: https://www.magiclotto.co.za
Information Officer / Privacy Email: privacy@magiclotto.co.za
General Support Email: hello@magiclotto.co.za

We have appointed an Information Officer who is registered with the Information Regulator as required by POPIA. In line with the Promotion of Access to Information Act 2 of 2000 (“PAIA”), our PAIA Manual is available on request from our Information Officer and describes how to request access to information we hold.

South Africa’s Information Regulator oversees POPIA and PAIA. You may lodge a complaint with the Information Regulator if you believe your personal information has been handled unlawfully (see Your Rights).

Scope

This policy applies to:

• Visitors to our website and logged-in account users
• Customers who deposit, play, or withdraw through our platform
• Support communications (email/WhatsApp/helpdesk) related to our services

Information We Collect

Account & Identity Information

• Identity data: name, surname, date of birth, ID/passport number, nationality (where required), username
• Contact data: email, mobile number, residential/billing address
• Verification documents: identity documents and proof of address where required for compliance and payout protection

Financial & Transaction Information

• Deposits and payments: transaction references, amounts, payment method, fraud-prevention signals
• Banking details for withdrawals: account holder name, bank name, account number (where required)
• Service records: ticket entries, game selections, draw participation, winnings and payout history

Technical, Device & Usage Information

• Device data: IP address, browser, operating system, device identifiers
• Usage data: pages viewed, clicks, session duration, error logs
• Approximate location: derived from IP address (not precise GPS)

Special Personal Information

We do not seek to collect special personal information (such as health, religious or biometric data). Where any identity check involves information that may be regarded as special personal information or a child's information, we process it only as permitted by sections 26 to 35 of POPIA — for example, where it is necessary to establish, exercise or defend a right or obligation in law, or to comply with an obligation under anti-money-laundering and verification laws.

Cookies & Similar Technologies

We use cookies and similar technologies for login sessions, preferences, security, and analytics. See Cookies & Tracking.

How We Use Your Information

To deliver and operate the service

• Create and manage your account
• Process deposits and transactions
• Record entries and provide account history
• Pay winnings and protect against wrongful payouts
• Provide customer support and service messages

To comply with legal obligations

• Identity and age verification (18+)
• Anti-money laundering / KYC checks where required (including record keeping)
• Responding to lawful requests from authorities
• Security compromise / breach assessment and notifications where required

To protect users and the platform

• Fraud detection, account security, and abuse prevention
• Risk management, auditing, and dispute handling
• Maintaining logs to investigate suspicious activity

To improve our product and user experience

• Analytics to understand site performance and improve usability
• Debugging and troubleshooting
• Developing new features and tools

Legal Basis (POPIA)

We process personal information in line with the eight conditions for lawful processing in POPIA (accountability; processing limitation; purpose specification; further processing limitation; information quality; openness; security safeguards; and data subject participation). Our lawful justification for any processing is one or more of the following:

• Conclusion / performance of a contract: to provide the services you request (section 11(1)(b))
• Legal obligation: where the law requires certain checks, records, or reporting (section 11(1)(c))
• Legitimate interests: ours, yours, or a third party's — for security, fraud prevention, and operational integrity (section 11(1)(d) and (f))
• Consent: where required (for example, certain marketing communications), which you may withdraw at any time (section 11(1)(a))

Verification (FICA / KYC)

Verification helps protect customers and the platform and may be required for lawful operation and payout integrity. Where verification is required, we may request identity documents and proof of address. We also keep certain records for legally required periods.

AI / Automated Processing

We may use automated tools (including AI-assisted checks) to help detect fraud, validate document authenticity, reduce errors, and speed up verification. These tools are used as decision-support and security controls.

• Examples: duplicate detection, mismatch flags, tamper detection indicators, formatting/consistency checks
• We do not sell or rent your documents or identity information

In line with section 71 of POPIA, we do not make a decision that results in legal consequences for you, or that substantially affects you, based solely on automated processing intended to profile you, unless that decision is permitted by law or taken in connection with the conclusion or performance of a contract with appropriate safeguards. Where an automated check materially affects you (for example, a verification or fraud outcome), you may request human review and make representations by contacting privacy@magiclotto.co.za.

Sharing & Operators (We do not sell data)

We do not sell personal information. We may share it only when necessary with:

Trusted service providers (operators/processors)

• Payment processors and financial partners to process transactions
• Hosting, security, and IT infrastructure providers
• Fraud prevention and verification partners (where required)
• Lottery operators and ticket-procurement partners, to facilitate participation
• Communication tools (email delivery, WhatsApp/support tools) for service communications

Where we use operators, we put written contracts in place requiring them to process personal information only on our instructions, to keep it confidential, and to maintain security safeguards consistent with section 21 of POPIA.

Authorities and legal disclosures

• Where required by law, court order, or lawful request
• To protect rights, safety, and prevent harm or fraud

Cross-Border Transfers

Some service providers or systems may be located outside South Africa. Where we transfer personal information to a third party in another country, we do so only on a basis permitted by section 72 of POPIA — for example where:

• the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection comparable to POPIA;
• you have consented to the transfer;
• the transfer is necessary to perform a contract with you (or to conclude or perform a contract in your interest); or
• the transfer is for your benefit and consent could not reasonably be obtained, but you would likely give it.

We will apply any further requirements set out in guidance issued by the Information Regulator on cross-border transfers.

Cookies & Tracking

We use cookies and similar technologies to:

• Maintain secure sessions and login functionality
• Remember preferences
• Protect against abuse and suspicious activity
• Measure performance and improve our site

Strictly necessary cookies are required for the site to function. For non-essential cookies (such as analytics), we rely on your choices. You can manage cookies through your browser settings or, where available, our cookie banner. Blocking some cookies may impact site functionality.

Security & Breach Notification

We use appropriate, reasonable technical and organisational measures to protect personal information (as required by section 19 of POPIA), including:

• Encryption in transit (SSL/TLS) and access control
• Authentication and permission management
• Logging and monitoring for suspicious activity
• Secure development and patch management practices
• Staff awareness and confidentiality controls

If we have reasonable grounds to believe that a security compromise has occurred affecting personal information, we will, as required by section 22 of POPIA, notify the Information Regulator and affected data subjects as soon as reasonably possible after discovering and assessing the compromise. From 1 April 2025, notifications to the Information Regulator are made through its eServices portal. Our notification to you will describe the possible consequences, the measures we are taking, and steps you can take to protect yourself.

Retention

We keep personal information only as long as necessary for the purposes described above, including legal and operational requirements.

• Account data: while your account is active and for a reasonable period thereafter for audits/disputes
• Compliance records: certain verification/transaction records may be kept for legally required periods (for example, FICA-related records)
• Tax and accounting: records may be retained as required by applicable financial/tax rules

When information is no longer needed, we delete, destroy or de-identify it in a manner that prevents its reconstruction, where reasonably possible.

Your Rights

Subject to POPIA, and using the prescribed forms where applicable, you have the right to:

• Request access to personal information we hold about you, and details of third parties who have had access (section 23)
• Request correction, updating, or deletion of inaccurate, irrelevant, excessive or unlawfully obtained information (section 24)
• Object, on reasonable grounds, to the processing of your personal information (section 11(3))
• Object to processing for purposes of direct marketing (section 11(3) and section 69)
• Withdraw consent where processing is based on consent
• Not be subject, in certain cases, to a decision based solely on automated processing (section 71) — see AI / Automated Processing
• Lodge a complaint with the Information Regulator, or institute civil proceedings

Under the 2025 POPIA Regulations, you may submit objections, requests and complaints free of charge and through accessible channels — including email, post, hand delivery, SMS or WhatsApp, or any other manner convenient to you.

To exercise a right, email privacy@magiclotto.co.za. We may need to verify your identity before fulfilling a request, and we will respond within the periods required by law.

Information Regulator — JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · POPIA complaints: POPIAComplaints@inforegulator.org.za · Website: https://inforegulator.org.za

Marketing Choices

We only send you direct marketing where the law allows. Under section 69 of POPIA and the 2025 POPIA Regulations:

• For direct marketing by electronic means (such as email, SMS, WhatsApp, automated calls and, per the Information Regulator's guidance, telephone calls), we obtain your prior consent before sending. An opt-out facility alone does not count as consent.
• We may contact you as an existing customer about our own similar products or services, where the limited exception in section 69(3) applies and you have not opted out.
• Every marketing message identifies us as the sender and gives you a free, easy way to ask us to stop.
• You can withdraw consent or opt out at any time, free of charge, via the unsubscribe link, your account preferences, or by emailing privacy@magiclotto.co.za.

Opting out of marketing does not stop essential service messages (security alerts, transaction notices, account messages).

Children

Our services are intended for adults. You must be 18 years or older to create an account and use MagicLotto services. We do not knowingly process the personal information of children (persons under 18) except as permitted by POPIA. If we become aware that personal information of a minor has been collected unlawfully, we will take reasonable steps to delete it.

Third-Party Links

Our website may link to third-party websites. We are not responsible for their privacy practices. Please review their policies before sharing personal information.

Policy Updates

We may update this policy from time to time to reflect changes in law, regulation, regulator guidance, or our practices. The latest version will always be available on this page, and we may notify you of material changes where appropriate.

Contact

If you have questions, requests, or concerns about privacy:

• Information Officer / Privacy: privacy@magiclotto.co.za
• General support: hello@magiclotto.co.za

You may also lodge a complaint with the South African Information Regulator (POPIA/PAIA) at POPIAComplaints@inforegulator.org.za or https://inforegulator.org.za.