Privacy Policy
1. Who We Are
SCOREZONE (PTY) LTD ("Lotiwins", "we", "us", "our"), registration number 95024, of Po Box 913, Maseru, 100, Lesotho, is the data controller responsible for your personal data when you use lotiwins.co.ls and any associated apps (the "Site").
This policy explains what personal data we collect, how and why we use it, who we share it with, how long we keep it, and the rights you have over it. It applies alongside our Terms and Conditions.
2. What Personal Data We Collect and Why
The table below summarises the main categories of personal data we collect, what we use each for, and the legal basis we rely on.
| Category of data | Examples | Why we use it | Lawful basis |
|---|---|---|---|
| Contact data | Mobile phone number | Account login (one-time passcodes); sending draw results, instant-win notifications, and service messages | Contract |
| Transaction data | Tickets purchased, wallet top-ups and balance, prizes won, loyalty points | Operating Prize Draws; calculating loyalty rewards | Contract; legal obligation |
| Payment data | Mobile money | Taking payment for tickets and paying out cash prizes | Contract |
| Technical data | IP address, device type, browser type, log-in timestamps | Keeping the Site secure; preventing fraud and multiple-account abuse | Legitimate interests |
| Usage data | Pages viewed, Prize Draws entered, referral activity | Understanding how the Site is used; improving our services | Legitimate interests |
| Marketing preferences | Whether you have opted in to promotional messages | Sending you offers and new Prize Draw alerts, where you have agreed | Consent |
3. Cookies and Similar Technologies
We use site functionality and affiliate cookies.
4. Who We Share Your Data With
We do not sell your personal data. We share personal data only where necessary, with:
Payment and Mobile Money Providers e.g. EcoCash / M-Pesa to take payment and pay out prizes;
SMS/Telecom Providers to send one-time passcodes, draw results, and service messages;
IT Hosting and Infrastructure Providers who store and process our encrypted data on our behalf, under contract;
Prize Fulfilment Partners (for example, couriers or dealerships) where needed to deliver a physical prize;
Marketing and Communication Service Providers to send promotional offers, newsletters, campaign updates, and other marketing communications where you have consented to receive such communications
Professional Advisers, Auditors, and Regulators or Law Enforcement where required by law or to establish, exercise, or defend legal claims.
Any third party who processes personal data on our behalf is required by contract to protect it and to use it only for the purposes we specify.
5. International Data Transfers
Where personal data is transferred outside Lesotho (for example, to a cloud hosting provider located elsewhere), we take steps to ensure it receives a comparable level of protection, consistent with the cross-border transfer requirements of the Data Protection Act, 2012 — including relying on transfers to jurisdictions recognised as providing adequate protection, or putting contractual safeguards in place.
6. How We Keep Your Data Secure
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse, including access controls, encryption of payment data in transit, and restricting staff access on a need-to-know basis. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
7. How Long We Keep Your Data
We keep account and transaction data for as long as your account is active, and for a further period afterwards to meet our legal, accounting, tax, and dispute-resolution obligations (5 years after account closure for financial records). Data we no longer need is deleted or anonymised.
8. Children's Privacy
The Site is not intended for, and we do not knowingly collect personal data from, anyone under 18 years of age. If we become aware that we hold personal data from someone under 18, we will delete it.
9. Marketing Communications
With your consent, we may send you SMS communications about new Prize Draws, promotions, special offers, and related marketing activities. You may withdraw your consent and opt out of these communications at any time by following the instructions provided in the message. You will continue to receive essential service messages (such as draw results and prize notifications) even if you opt out of marketing.
10. Your Rights
Subject to the conditions and exemptions in the Data Protection Act, 2012, you have the right to:
ask us for a copy of the personal data we hold about you;
ask us to correct inaccurate or incomplete data;
ask us to delete data we no longer have a lawful basis to hold;
object to, or ask us to restrict, certain processing (for example, direct marketing);
ask for certain data to be provided to you or transferred to another provider in a portable format;
lodge a complaint with Lesotho Data Protection Commission if you believe we have not handled your data properly.
To exercise any of these rights, contact us at dataprotection@lotiwins.co.ls. We may need to verify your identity before responding.
11. Links to Other Websites
The Site may contain links to third-party websites (for example, a payment provider's site). We are not responsible for the privacy practices of those sites and encourage you to review their own privacy policies.
12. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices or the law. We will post the updated version on the Site with a new effective date, and where a change is material, we will take reasonable steps to notify registered users.
13. Contact Us
If you have a question about this policy or how we handle your personal data, contact us at:
Email: dataprotection@lotiwins.co.ls