luky33 Privacy Policy – How We Handle Your Data

This Privacy Policy ("Policy") describes how luky33 ("we", "us", "our") collects, processes, stores, and protects the personal data of individuals ("you", "your", "Player") who access or use the luky33 online gaming platform available at luky33.asia and all associated subdomains, mobile interfaces, and services (collectively, the "Platform").

We are committed to handling your personal data with respect, transparency, and in accordance with the data protection obligations arising from our international gaming licence. We encourage you to read this Policy carefully before using the Platform. By registering an account or using the Platform in any capacity, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

luky33 is an internationally licensed online gaming operator serving players across Pakistan. The luky33 Platform provides online casino games, sports betting (including cricket betting on PSL, international T20s, Tests, and ODIs), live dealer games, arcade fish games, and related entertainment services.

For the purposes of data protection law, luky33 acts as the data controller in respect of personal data collected from Players through the Platform. This means luky33 determines the purposes and means by which your personal data is processed. Our primary support contact for data-related queries is [email protected].

luky33 collects the following categories of personal data, depending on how you interact with the Platform:

luky33 collects personal data through the following means:

• Directly from you: when you complete the account registration form, submit KYC documents, contact support, set account preferences, or voluntarily provide information in any Platform interaction.
• Automatically through technology: our servers, analytics systems, and session tracking mechanisms automatically record technical and gaming activity data each time you access the Platform.
• From payment processors: when you make a deposit or request a withdrawal, luky33 receives transaction confirmation data from JazzCash, EasyPaisa, your bank, or the cryptocurrency network as applicable.
• From identity verification services: where luky33 engages a third-party KYC verification provider to assist in confirming the authenticity of identity documents submitted by Players.
• From fraud prevention partners: luky33 may receive data from trusted fraud detection services that help identify patterns of bonus abuse, multi-accounting, or suspicious financial behaviour.

luky33 processes your personal data only where a valid lawful basis exists for doing so. The primary lawful bases on which luky33 relies are as follows:

• Contractual Necessity: Processing of registration data, financial data, and gaming activity data is necessary for luky33 to perform its contractual obligations to you as a Player — specifically, to operate your account, process transactions, and provide gaming services.
• Legal Obligation: KYC verification, anti-money laundering checks, and retention of certain financial records are processed because luky33 is legally required to do so under its gaming licence conditions and applicable regulatory requirements.
• Legitimate Interests: Technical and device data, fraud prevention processing, and security monitoring are processed on the basis of luky33's legitimate interests in maintaining a secure, fair, and operationally sound platform for all Players.
• Consent: Direct marketing communications via SMS, email, or in-app notification are sent only where you have provided clear, voluntary consent to receive them. You may withdraw consent at any time from your Account settings.

luky33 uses the personal data we hold about you for the following specific purposes:

• Creating and managing your luky33 account, including authenticating your identity on each login.
• Processing deposits and withdrawals in PKR via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency channels.
• Conducting mandatory KYC and anti-money laundering verification processes required by our gaming licence.
• Delivering the full range of luky33 gaming and sports betting services, including cricket betting, slots, live dealer games, and fish games.
• Calculating, crediting, and managing bonuses, cashback, free spins, and VIP programme rewards.
• Detecting and preventing fraud, bonus abuse, multi-accounting, collusion, and money laundering activities on the Platform.
• Monitoring gaming patterns to identify Players who may be exhibiting signs of problem gambling and to facilitate responsible gaming interventions.
• Providing customer support in English and Urdu via live chat, email, and other channels.
• Sending transactional communications including deposit confirmations, withdrawal notifications, and security alerts.
• Sending promotional and marketing communications to Players who have consented to receive them.
• Conducting internal analytics to understand platform usage patterns, improve user experience, and develop new product features.
• Complying with legal holds, court orders, regulatory inquiries, or other lawful demands for information.

luky33 uses cookies and similar tracking technologies on the Platform to ensure proper functionality, improve performance, and understand how Players use the Platform. The following categories of cookies are used:

• Strictly Necessary Cookies: Essential for the Platform to function correctly. These include session authentication cookies that keep you logged in and security cookies that protect your account. These cannot be disabled.
• Functional Cookies: Remember your preferences, language settings, and game history to personalise your luky33 experience between sessions.
• Performance & Analytics Cookies: Collect anonymised data about how Players navigate the Platform, which game categories are most visited, and where technical errors occur. This data helps luky33 improve the Platform.
• Security Cookies: Used by luky33's fraud detection systems to identify suspicious session behaviour, unusual login patterns, and potential account takeover attempts.

luky33 does not sell your personal data to any third party. We share your data only in the following limited circumstances and strictly on a need-to-know basis:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency networks receive the transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and security standards.
• KYC Verification Providers: Where luky33 engages a third-party identity verification service to process your KYC documents, that provider receives only the data necessary to perform the verification check and is contractually bound to data confidentiality obligations.
• Game Software Providers: Certified game studios whose titles are hosted on the luky33 Platform may receive anonymised session and wagering data necessary to operate their games. These providers do not receive your name, contact details, or financial data.
• Fraud & Compliance Services: luky33 may share limited data with specialist fraud detection and regulatory compliance service providers to fulfil our obligations under our gaming licence. All such providers are contractually bound to process data only for the specified purpose.
• Legal & Regulatory Authorities: luky33 will disclose personal data to law enforcement, regulatory bodies, or courts where required to do so by a valid legal obligation, warrant, or court order.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of luky33's assets, your personal data may be transferred to the acquiring entity, provided that entity agrees to honour this Privacy Policy.

luky33 operates internationally and may process or store your personal data on servers located outside Pakistan. Where your data is transferred to countries that may not provide an equivalent level of data protection to Pakistan, luky33 takes appropriate safeguards to ensure that your data remains protected to the standards set out in this Policy.

Safeguards employed by luky33 for international transfers include data processing agreements incorporating standard contractual clauses with all third-party service providers who receive personal data, and encryption of all data in transit using industry-standard protocols.

luky33 retains your personal data only for as long as is necessary for the purposes for which it was collected, and for as long as is required by applicable legal and regulatory obligations. The following retention principles apply:

• Active Account Data: Registration, financial, and gaming activity data is retained for the full duration of your active luky33 account plus a minimum period of five (5) years following account closure, in compliance with our gaming licence anti-money laundering retention requirements.
• KYC Documents: Identity verification documents are retained for a minimum of five (5) years from the date of verification, or longer if required by applicable law or regulatory order.
• Support Communications: Live chat transcripts and email correspondence are retained for up to three (3) years from the date of the interaction, unless the communication relates to a formal complaint or legal matter, in which case it is retained for the duration of the matter plus an additional period as advised by legal counsel.
• Cookie Data: Session cookies are deleted when you close your browser. Persistent functional cookies expire within 90 days. Analytics data is retained in aggregated, anonymised form for up to 24 months.
• Closed or Suspended Accounts: Where an account is closed at the Player's voluntary request, data is retained as specified above. Where an account is suspended for fraud or compliance reasons, data may be retained indefinitely for legal purposes.

Subject to applicable law and the terms of our gaming licence, you have the following rights in respect of the personal data luky33 holds about you:

To exercise any of these rights, please contact luky33 at [email protected] with your full name, registered mobile number, and a clear description of your request. luky33 will respond within 30 days. Note that certain rights may be limited where data retention is required by legal obligation under our gaming licence.

luky33 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. Our security infrastructure includes:

• 256-bit SSL/TLS encryption on all data transmitted between your device and luky33's servers.
• Encrypted storage of all personal and financial data at rest using AES-256 encryption.
• Two-factor authentication options for Player accounts, providing an additional access control layer.
• Automated brute force protection and anomalous login detection systems on all account access points.
• Regular third-party security penetration testing of the Platform infrastructure.
• Strict access controls limiting employee access to personal data on a need-to-know basis, with comprehensive access logging.
• Dedicated security team conducting ongoing monitoring of the Platform for threats and vulnerabilities.

Notwithstanding the above, no data transmission over the internet or electronic storage system is completely secure. While luky33 employs industry best practices, we cannot guarantee absolute security and Players accept this inherent risk when using any online platform.

The luky33 Platform is intended exclusively for adults aged 21 years and above. luky33 does not knowingly collect personal data from individuals under the age of 21. If we become aware that personal data has been collected from a minor, we will immediately delete that data and permanently close the associated account.

luky33 employs both declaration-based age confirmation at registration and documentary KYC verification (CNIC) prior to first withdrawal to enforce the 21+ age requirement. We actively cooperate with responsible gaming organisations and parental control initiatives to prevent underage gambling.

luky33 may send you promotional communications including information about new games, special promotions, seasonal offers, PSL betting markets, and VIP programme updates. Marketing communications are sent only to Players who have expressly opted in to receive them.

• You may opt out of marketing SMS messages by replying STOP to any marketing message or by updating your preferences in Account Settings.
• You may opt out of marketing emails by clicking the unsubscribe link included in every marketing email.
• Opting out of marketing communications does not affect transactional communications — you will continue to receive deposit confirmations, withdrawal notifications, security alerts, and other essential account communications regardless of your marketing preferences.
• luky33 does not share your contact details with any third-party advertisers or marketing agencies.

The luky33 Platform may contain integrations with third-party services, including payment providers such as JazzCash and EasyPaisa, and certified game studio software. luky33 is not responsible for the privacy practices of these third parties. When you interact with a third-party service through the Platform — for example, when completing a JazzCash payment — your interaction with that service is governed by that provider's own privacy policy, not this Policy.

luky33 strongly recommends that Players review the privacy policies of any third-party service they use in connection with the Platform, particularly the payment providers through which deposits and withdrawals are conducted.

luky33 reviews this Privacy Policy periodically and may update it to reflect changes in our data practices, applicable regulatory requirements, or operational developments. When material changes are made, luky33 will notify registered Players by email or in-platform notification at least 7 days before the revised Policy takes effect.

The date of the most recent update is clearly displayed at the top of this Policy and in the Last Updated bar above. Continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the changes. If you do not accept the revised Policy, you may request account closure by contacting our support team.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, want to raise a privacy concern, or need to report a suspected data breach, please contact the luky33 privacy team through the following channels:

• Privacy Enquiries & Data Rights Requests: [email protected] — please include "Privacy Request" in the subject line and your luky33 Player ID or registered mobile number in the message body.
• Live Support: Available 24/7 on the luky33 Platform via the live chat widget. Our agents can raise privacy requests to the compliance team on your behalf.
• Response Timeframe: luky33 aims to acknowledge all privacy requests within 3 business days and provide a full response within 30 calendar days. Complex requests involving large volumes of data may require additional time, in which case we will notify you of the extended timeline.