Privacy Policy

Effective date: 22 September 2026

This policy explains how LottoPark handles personal information when you visit lottopark.com or casino.lottopark.com, open an account, use our lottery and gaming services, make payments, take part in promotions, work with our affiliate programme or contact us.

LottoPark is operated by 3-102-967075 Sociedad de Responsabilidad Limitada, a company registered in the Republic of Costa Rica under registration number 3-102-967075, with its registered office at Province 01 San Jose, Canton 02 Escazu, San Rafael, Spazio Ejecutivo Building, Fourth Floor, Office Seventeen, Costa Rica. In this policy, “LottoPark”, “we”, “us” and “our” refer to this company. It is the data controller responsible for the processing described here across both domains and the LottoPark affiliate programme.

For privacy questions or a request concerning your information, contact [email protected] and include “Privacy request” in the subject. This policy should be read alongside our Cookies Policy and Terms and Conditions. Reading or using the website does not, by itself, give consent to optional marketing or tracking.

1. Information covered by this policy

The information needed depends on the services you use and any verification required for your account. It can include:

Account and contact information: your name, date of birth, email address, telephone number, country, residential address, account identifier, language and account preferences.
Identity and eligibility information: identification and address documents, verification results and information needed to check age, identity, payment ownership, residence or the source of funds or wealth.
Transactions and activity: deposits, withdrawals, payment references, balances, lottery selections and orders, draw entries, game activity, stakes, results, winnings, refunds and relevant timestamps.
Promotions and preferences: bonus participation, reward activity, promotional eligibility, referral information and your marketing choices.
Affiliate information: business and contact details, identity and verification records, referral and commission records, and information needed to administer affiliate payments.
Technical information: IP address, approximate location inferred from it, browser and device details, language settings, pages visited, error reports, login and security records, and cookie or similar identifiers.
Communications and protection requests: support messages, community-chat content you submit, complaints, privacy requests, account restrictions and information you provide when asking for responsible-gambling assistance.

You do not need to provide a medical diagnosis or medical records to request a gambling restriction or self-exclusion. Please provide accurate information and keep your account details current. Do not send passwords, full card security details or more sensitive information than is needed to resolve your request. If documents are required, follow the secure submission instructions given for your account.

Community chat is for communication between players, not customer support. Information you post there can be seen by other participants. Do not post identity documents, payment details or private account information in community chat.

2. Where information comes from

We receive information directly from you when you register, update your account, place an order, play a game, make a payment or contact support. Website and account activity also generate technical and transaction records.

Service partners may provide payment confirmations, identity-verification results, lottery fulfilment and prize information, game-session records or security alerts needed to deliver and protect the service. If you arrive through an affiliate link, the referral may be associated with your visit or account, subject to the relevant tracking choices. Information collected by an external provider for its own purposes is also governed by that provider’s privacy notice.

3. How and why we use information

We use information for the purposes below. The legal basis depends on the applicable law and the particular processing. Where consent is required, we obtain it separately; simply visiting the website is not consent.

Providing the service you request: account administration, lottery orders, game access, results, payments, eligible rewards, affiliate agreements and service support. We rely on the performance of our agreement with you or steps you request before entering it, where that legal basis is available.
Identity, eligibility and compliance: checking age, identity and payment ownership, meeting record-keeping duties and responding to lawful requests. We rely on a legal obligation where the applicable law imposes the relevant duty. For proportionate checks not required by law, our interests are preventing fraud, protecting users and ensuring the service is used by eligible people.
Security, moderation and disputes: detecting unauthorised access, fraud, misuse, duplicate-account abuse and technical faults; moderating community features and establishing, exercising or defending legal rights. Where permitted, we rely on legitimate interests in protecting users and operating a reliable service, after assessing the impact on your rights.
Responsible gambling: acting on your requests for restrictions, self-exclusion or assistance, keeping the minimum records needed to maintain those restrictions, and preventing inappropriate promotional contact. We rely on applicable legal duties and, where permitted, our legitimate interests in protecting users from gambling harm and honouring restrictions. If sensitive information requires an additional legal condition, such as explicit consent, that condition must be satisfied before we use it.
Service improvement: diagnosing faults and improving usability. Necessary operational diagnostics support our legitimate interests in a reliable service where permitted; optional analytics requiring consent is used only on that basis.
Marketing and campaign measurement: sending offers and measuring advertising or affiliate activity when permitted and in line with your choices. We rely on consent where required. Where the law permits a different basis for direct marketing, we assess the relevant legitimate interests and respect your right to object.

Some information is necessary to open an account, verify eligibility, fulfil an order or process a payment. If you do not provide it, we may be unable to provide the relevant service. Optional marketing choices do not change your eligibility to use the core service.

4. Payments and identity checks

Payment providers and verification partners process information necessary for the transactions or checks they perform. Depending on the method, this can include your contact details, payment-account information, transaction identifiers, amount, currency and verification documents. LottoPark uses the transaction and verification information needed to administer your account, reconcile payments, investigate problems and meet relevant obligations.

The payment methods available to you are shown in the payment flow. Read the provider information presented there, particularly if a provider handles information as an independent controller. Never email your full card number, card security code, banking password or one-time authentication code to customer support.

5. Who receives information

Information is shared for defined purposes with the people and organisations that need it, including:

Authorised staff and suppliers providing hosting, account administration, customer support, communications and security.
Lottery fulfilment partners and game providers where needed to process the order, game session, result or prize.
Payment, banking, identity-verification and fraud-prevention providers involved in the relevant transaction or check.
Professional advisers, courts, regulators and public authorities when disclosure is required by law or justified to establish, exercise or defend legal rights.
Analytics, marketing or affiliate providers for the purposes and subject to the choices explained in the relevant notices.

Some providers act on our instructions; others have their own legal responsibilities and act independently. If a business transfer affects personal information, its use and any required notices or choices must be addressed as part of that transfer. A change in ownership does not remove your applicable data-protection rights.

6. International processing

LottoPark’s operator and data controller is based in Costa Rica. Providing an international lottery and gaming service can also involve service providers processing information in other countries. Privacy laws and available protections may differ between those countries.

Our policy is to permit an international transfer only when the conditions required by the applicable data-protection law are satisfied. Where a transfer requires additional protection, this may involve an applicable adequacy decision, approved contractual safeguards with any necessary supplementary measures, or another transfer mechanism permitted for that particular situation. These alternatives are not a statement that every provider operates under the same mechanism.

To ask where your information is processed, which transfer arrangement applies or how to obtain details of relevant safeguards, email [email protected]. We will explain the arrangement relevant to your request, subject to lawful confidentiality restrictions.

7. How long information is kept

Our retention policy uses the following standard periods. We delete information sooner when it is no longer needed and no lawful reason remains to keep it. A different period applies where a binding law requires earlier deletion or longer retention, or a specific legal hold is necessary for a dispute, investigation or claim.

Core account and identity-verification records: for the life of the account and normally five years after account closure. This period covers records needed to verify the customer relationship, address financial crime risks and resolve claims; it is not a reason to retain every optional profile detail.
Financial, lottery and gaming transaction records: normally five years after the transaction is completed. A record also needed to document an ongoing account or unresolved matter follows the applicable account or legal-hold period.
Affiliate account, verification and payment records: normally five years after the relationship ends or the relevant payment is completed, as appropriate to the record.
Support enquiries and complaints: normally three years after the matter is closed. Records forming part of a financial, identity or legal investigation may follow the relevant longer period.
Routine security, login and technical logs: normally up to 12 months from creation, unless a specific incident requires relevant records to be retained for longer.
Community-chat messages: normally up to 90 days from posting. Content needed to address a report, abusive conduct, fraud or a legal requirement may be retained for the relevant case.
Marketing permissions: while we rely on them, with evidence normally retained for three years after the last reliance or withdrawal. We retain only the limited suppression information needed to prevent marketing to someone who has opted out.
Restrictions and self-exclusion: minimum identifying and restriction records while the restriction remains in effect, including a permanent restriction, and normally five years after a restriction is lawfully lifted. An expired selected period does not end retention while an exclusion remains active pending a permitted reopening request.

Our backup-retention policy is up to 90 days after information is removed from active systems. During that period, deleted information is not to be used for ordinary operations; if a backup must be restored, the relevant deletion and suppression instructions must be reapplied. A documented legal preservation requirement may justify keeping the necessary records separately for longer.

Where a longer period is justified, access is restricted to the reason for retention and the record is reviewed when that reason ends. At the end of the applicable period, information is deleted or anonymised. Contact us to ask which period applies to a particular record.

8. Your choices and rights

Depending on the law that applies to your information, you may have rights to access and receive a copy of it, correct inaccuracies, request deletion or restriction, obtain portable data, object to particular uses and withdraw consent. These rights can be subject to legal conditions and exceptions.

To make a request, email [email protected] with enough information to identify your account and explain what you need. We may ask for proportionate verification before disclosing information or changing records. We aim to acknowledge requests within two working days. Where Costa Rican law requires a response to a correction request within five working days, we meet that period. Other requests are answered without undue delay and within the applicable legal deadline; where a one-month period applies, any legally permitted extension and its reasons will be explained within that first month. We will explain any justified refusal or limitation.

You can object to direct marketing at any time. Withdrawing consent does not affect processing that was lawful before withdrawal. A deletion request does not automatically cancel a confirmed lottery order or remove a payment, fraud-prevention or self-exclusion record that must lawfully be retained.

You may also complain to the competent data-protection authority. In Costa Rica, this is the Agencia de Protección de Datos de los Habitantes (PRODHAB). Where other data-protection laws give you a right to complain to an authority in your country, those rights remain available.

9. Marketing, cookies and automated processing

Service messages, such as order confirmations, security notices and responses to your requests, are different from promotional messages. To stop promotional emails, use the unsubscribe option in the message or contact support. Opting out of marketing does not prevent necessary account or transaction communications.

Cookies and similar technologies can support account sessions, preferences, analytics and campaign attribution. Our Cookies Policy explains the categories and available controls. Optional tracking must not be treated as a condition of accepting this privacy notice.

Technical checks may be used to detect unusual account or transaction activity. If a restriction or decision affecting your account is unclear, contact support to request an explanation and review. For a decision that significantly affects you, you may ask for a review by a person, provide relevant information and challenge the outcome. Any additional rights concerning automated decision-making under applicable law remain available.

10. Security and your account

We use technical and organisational measures designed to protect information against unauthorised access, loss, misuse and alteration. No online service can promise absolute security.

Use a strong, unique password, protect access to your email account, sign out on shared devices and do not share your account. Contact support promptly if you believe someone has accessed your account or used your information without permission.

11. Age restrictions and external services

LottoPark is for adults aged at least 18, or the higher minimum age required for the relevant service in their location. If you believe an underage person has provided information or opened an account, contact support so the account and information can be reviewed and handled appropriately.

Links to external websites and services do not make their privacy practices part of this policy. Read the relevant provider’s notice before sharing information with it.

12. Changes and contact

We may update this policy when our services, processing practices or legal obligations change. Material changes will be brought to your attention in an appropriate way, and any additional notice or consent required by law will be provided or obtained before the relevant new processing.

For questions, requests or concerns about your information, email [email protected] with “Privacy request” in the subject.