goloto Privacy Policy

1 Who We Are

goloto is an online casino and sports betting platform accessible at goloto.app, operated for and on behalf of Pakistani players and other users in jurisdictions where goloto's services are made available. For the purposes of this Privacy Policy, goloto acts as the data controller in respect of the personal data collected from users of the platform.

goloto is committed to handling all personal data in a manner consistent with applicable international data protection standards and in accordance with this Privacy Policy. Any questions about goloto's data practices may be directed to our support team at the contact details set out in Section 13 of this Policy.

2 Data We Collect

goloto collects personal data from users across several categories. The specific data collected depends on how you use the goloto platform and at what stage of your relationship with us you are.

2.1 Registration Data

When you create a goloto account, we collect information including your full legal name, date of birth, email address, mobile phone number, residential address (including city and province within Pakistan, such as Karachi, Lahore, Islamabad, or Faisalabad), and your chosen username and password.

2.2 Identity Verification Data (KYC)

As part of our legal obligations and to process withdrawals, goloto may collect copies of government-issued identity documents such as your CNIC (Computerised National Identity Card), passport, or driving licence. We may also request a recent utility bill or bank statement as proof of address, and in some cases a selfie photograph for liveness verification.

2.3 Financial Data

When you make deposits or withdrawals through goloto, we collect transaction records including payment method details, transaction amounts in PKR, transaction timestamps, and references from payment processors such as JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, Visa, Mastercard, and USDT TRC20 wallets. goloto does not store full card numbers on its own servers — payment card data is handled directly by our PCI-compliant payment processing partners.

2.4 Technical and Usage Data

goloto automatically collects certain technical data when you access the platform. This includes your IP address, browser type and version, device type and operating system, session duration, pages visited, games played, bet history, and login timestamps. This data is collected through cookies, server logs, and similar tracking technologies as described in Section 6.

2.5 Communications Data

When you contact goloto's customer support team via email, live chat, or any other channel, we retain records of those communications, including the content of your messages and any documentation you provide. This helps us resolve disputes, improve our service, and maintain a history of support interactions for compliance purposes.

3 How We Use Your Data

goloto uses the personal data we collect for the following specific purposes:

goloto will not use your personal data for any purpose that is materially incompatible with the purposes listed above without first notifying you and, where legally required, obtaining your consent.

4 Legal Basis for Processing

goloto processes your personal data on the following legal bases:

• Contractual Necessity: Processing required to perform our obligations under the goloto Terms and Conditions, including account management, payment processing, and service delivery;
• Legal Obligation: Processing required to comply with applicable anti-money laundering laws, identity verification obligations, tax reporting requirements, and other legal or regulatory duties;
• Legitimate Interests: Processing carried out in furtherance of goloto's legitimate business interests, including fraud prevention, platform security, and service improvement, provided those interests are not overridden by your rights and freedoms;
• Consent: Where goloto relies on your consent as the basis for processing — for example, in the context of marketing communications — you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5 Sharing Your Data

5.1 Service Providers

goloto engages carefully selected third-party service providers who process personal data on our behalf to enable core platform functions. These include payment processing partners (such as JazzCash, EasyPaisa, and card payment processors), identity verification and KYC service providers, cloud infrastructure and data hosting providers, customer support platform operators, and fraud detection and analytics vendors. All such providers are bound by data processing agreements that restrict their use of your data to the specific purposes for which it was shared.

5.2 Legal and Regulatory Disclosure

goloto may disclose personal data to law enforcement agencies, regulatory bodies, financial intelligence units, or other public authorities where required to do so by applicable law, court order, or regulatory directive. goloto will not disclose data beyond the minimum necessary to satisfy such requirements.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of goloto's assets, personal data held by goloto may be transferred to the relevant successor entity. Users will be notified of any such transfer and any material changes to how their data will be handled as a result.

6 Cookies & Tracking Technologies

6.1 What Are Cookies

Cookies are small text files placed on your device when you visit the goloto platform. They help us remember your preferences, keep you logged in securely, understand how you use the platform, and deliver relevant promotional content where applicable.

6.2 Types of Cookies goloto Uses

• Strictly Necessary Cookies: Essential for the platform to function. These enable your goloto login session, remember your language preference, and maintain security tokens. They cannot be disabled without breaking core functionality.
• Performance & Analytics Cookies: Used to collect anonymised data about how users interact with goloto pages, which games are most popular, and where technical errors occur. This data helps us improve the platform experience for all Pakistani players.
• Functionality Cookies: Remember your personal preferences such as currency display, notification settings, and preferred game categories to provide a more tailored experience across sessions.
• Marketing Cookies: Used to measure the effectiveness of goloto's promotional campaigns and, where you have consented, to show you relevant goloto offers. goloto does not use marketing cookies to build profiles on behalf of third-party advertisers.

6.3 Managing Your Cookie Preferences

You can manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair your ability to use goloto's services. For other cookie categories, adjusting your browser settings will be sufficient for most users. Where goloto operates a dedicated cookie consent mechanism, your preferences set therein will take precedence.

7 Data Retention

goloto retains personal data for as long as is necessary to fulfil the purposes set out in this Privacy Policy or as required by applicable law and regulation. The following general retention guidelines apply:

• Active Account Data: Retained for the duration of your goloto account and for a minimum of five (5) years following account closure, in accordance with anti-money laundering record-keeping obligations;
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of verification or from the date of account closure, whichever is later;
• Transaction Records: Retained for a minimum of five (5) years to satisfy financial record-keeping and audit requirements;
• Customer Support Communications: Retained for three (3) years from the date of the last communication, unless a longer period is required in connection with an ongoing dispute or investigation;
• Technical and Usage Data: Retained in identifiable form for up to twenty-four (24) months, after which it is anonymised or deleted.

Where retention beyond these periods is required by an ongoing legal proceeding, regulatory investigation, or similar obligation, goloto will retain the relevant data until that obligation is resolved.

8 Your Rights

As a goloto user, you hold the following rights in respect of your personal data. These rights are substantive and goloto is committed to honouring them within the timeframes set out below.

To exercise any of these rights, please contact goloto's support team at [email protected] with the subject line "Data Rights Request." goloto will acknowledge your request within five (5) business days and respond substantively within thirty (30) days. Identity verification may be required before goloto can process certain requests.

9 Data Security

goloto implements a range of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• TLS/SSL encryption for all data transmitted between your device and the goloto platform;
• Encryption at rest for sensitive data stored on goloto's servers;
• Role-based access controls ensuring that personal data is accessible only to goloto employees and contractors who require it to perform their specific functions;
• Regular internal security reviews, vulnerability assessments, and penetration testing;
• Secure disposal procedures for data that has reached the end of its retention period;
• Incident response procedures to detect, investigate, and notify affected users of any data security breach in a timely manner.

10 Children's Privacy

The goloto platform is strictly intended for adults aged 21 years and above. goloto does not knowingly collect personal data from individuals under the age of 21. If goloto discovers or is notified that personal data has been collected from a person under the minimum age, that data will be deleted promptly and the associated account will be closed.

If you are a parent or guardian and believe that a minor under your care has registered a goloto account or provided personal data to the platform, please contact us immediately at [email protected] and we will take appropriate action without delay.

11 International Data Transfers

goloto's infrastructure and some of its third-party service providers may be located in jurisdictions outside of Pakistan. When personal data is transferred internationally, goloto takes steps to ensure that appropriate safeguards are in place to protect your data to a standard consistent with this Privacy Policy and applicable international data protection requirements.

Such safeguards may include contractual clauses with service providers requiring them to protect personal data to standards equivalent to those described in this Policy, and the selection of service providers operating under recognised international data protection frameworks. Where you have questions about specific international transfers applicable to your data, please contact us at the details in Section 13.

12 Updates to This Privacy Policy

goloto reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or the services we provide. When material changes are made, goloto will notify registered users via the email address on file and will post a prominent notice on the platform indicating that the Policy has been updated.

The effective date at the top of this document indicates when this Privacy Policy was last revised. We encourage you to review this Policy periodically. Your continued use of the goloto platform following publication of any updated Privacy Policy constitutes your acceptance of those changes.

13 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to goloto's handling of your personal data, please reach out to our support team using the details below:

• Email: [email protected]
• Subject Line for Data Requests: "Privacy / Data Rights Request"
• Support Hours: 24 hours a day, 7 days a week
• Languages: English and Urdu
• Response Time: Acknowledgement within 5 business days; full response within 30 days

goloto is committed to resolving privacy concerns promptly and transparently. If you are not satisfied with goloto's response to a data-related complaint, you may have the right to escalate the matter to a relevant supervisory or regulatory authority depending on your jurisdiction.