Privacy Policy
Last updated: 1 August 2026. This Privacy Policy explains how WIN777 (Pty) Ltd (“we”, “us”, “our”) collects, uses, stores, and protects your personal information when you use win-a-lotto.com (“Service”). We are committed to compliance with the Protection of Personal Information Act 4 of 2013 (POPIA), the EU General Data Protection Regulation (GDPR), and the UK GDPR where applicable.
1. Who We Are
WIN777 (Pty) Ltd is a company incorporated under the laws of the Republic of South Africa. We operate win-a-lotto.com, an entertainment platform that generates lottery number suggestions using mathematical and numerological algorithms.
Data controller contact: admin@win-a-lotto.com
2. Information We Collect
2.1 Information You Provide
- Account registration: First name, last name, email address, password (stored as a cryptographic hash — never in plain text).
- Profile information: Date of birth (used only for Personal Numerology number generation — optional), phone number (optional), place of birth (optional), favourite colour (optional).
- Payment information: Billing name and payment method details. Card numbers are processed and stored by our payment provider (Peach Payments) — we do not store full card numbers on our servers.
- Communications: When you contact us by email, we retain your message and our response.
2.2 Information Collected Automatically
- Usage data: Pages visited, features used, number of reveals generated, lotteries selected, methods chosen.
- Device and connection data: IP address, browser type and version, operating system, referral URL, time zone.
- Cookies and similar technologies: See our Cookie Policy for full details.
2.3 Derived Data
- Generated numbers: The number sets produced by our algorithms for your account are stored so they can appear in your My Entries history.
- Match records: After each official lottery draw, we compare your saved predictions against the results and record how many numbers matched.
- Referral data: If you participate in our referral programme, we record which accounts you referred and the status of related credits.
3. How We Use Your Information
| Purpose | Legal Basis (GDPR/UK GDPR) |
|---|---|
| Providing and managing your account and subscription | Contract performance |
| Processing payments and managing billing | Contract performance |
| Generating personalised number suggestions (numerology uses date of birth) | Contract performance / Consent |
| Sending transactional emails (receipts, password resets, draw reminders) | Contract performance |
| Displaying your match history and leaderboard position | Contract performance / Legitimate interest |
| Improving our algorithms and Service | Legitimate interest |
| Detecting and preventing fraud and abuse | Legitimate interest / Legal obligation |
| Complying with legal obligations (tax, regulatory requests) | Legal obligation |
| Sending marketing communications (optional) | Consent |
| Analytics and site performance monitoring | Legitimate interest / Consent (for cookies) |
4. Data Sharing
We do not sell your personal information. We share it only in the following circumstances:
- Payment processor (Peach Payments): To process subscription and content pack payments. Peach Payments processes data under its own privacy policy and PCI DSS compliance programme.
- Email service provider: To deliver transactional and marketing emails on our behalf. Processors are bound by data processing agreements.
- Analytics providers: Anonymised or pseudonymised usage data may be shared with analytics tools.
- Legal requirements: We may disclose information where required by law, court order, or regulatory authority, or to protect the rights and safety of our users or the public.
- Business transfers: If WIN777 (Pty) Ltd is acquired, merged, or sold, your data may transfer to the successor entity. You will be notified in advance.
5. Data Retention
- Active accounts: We retain your data for as long as your account is active.
- Closed accounts: We delete or anonymise personal data within 90 days of account closure, except where we are required by law to retain it (e.g. financial records, which are kept for 5 years under South African tax law).
- Generated numbers and match history: Retained for the life of your account, then deleted on closure.
- Payment records: Retained for 5 years for accounting and tax compliance.
- Suppression list (unsubscribe): Email addresses on our marketing suppression list are retained indefinitely to honour your opt-out.
6. Data Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These include:
- HTTPS encryption for all data in transit (TLS 1.2+).
- Passwords stored as cryptographic hashes (bcrypt).
- Access to personal data restricted to authorised personnel on a need-to-know basis.
- Regular security reviews of our hosting environment.
No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within the timeframes required by law.
7. International Data Transfers
Our servers are hosted in South Africa. If you access our Service from the European Union, United Kingdom, or another country with data protection laws, your data will be transferred to and processed in South Africa. We ensure that such transfers are governed by appropriate safeguards, including standard contractual clauses where required.
8. Your Rights
Depending on your jurisdiction, you have the following rights regarding your personal information:
- Access: Request a copy of the personal information we hold about you.
- Correction: Request correction of inaccurate or incomplete information.
- Deletion: Request deletion of your personal data (“right to be forgotten”), subject to legal retention obligations.
- Restriction: Request that we restrict processing of your data in certain circumstances.
- Portability: Request your data in a structured, machine-readable format (EU/UK GDPR).
- Object: Object to processing based on legitimate interest, including for direct marketing.
- Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email admin@win-a-lotto.com. We will respond within 30 days (or within 72 hours for urgent matters relating to a breach). We may need to verify your identity before processing certain requests.
South African residents: You also have the right to lodge a complaint with the Information Regulator (South Africa) at www.justice.gov.za/inforeg.
EU residents: You have the right to lodge a complaint with your national Data Protection Authority.
UK residents: You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
9. Children’s Privacy
Our Service is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately and we will delete it.
10. Marketing Communications
With your consent, we may send you emails about new features, promotions, and lottery-related content. You can unsubscribe at any time by clicking the “Unsubscribe” link in any marketing email or by emailing us. We will not use your information for marketing purposes without your explicit consent.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the “Last updated” date. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.
12. Contact and Information Officer
WIN777 (Pty) Ltd
Republic of South Africa
Email: admin@win-a-lotto.com
Information Officer (POPIA): To be appointed — contact the email above in the interim.