Luky22 Privacy Policy – How We Handle Your Personal Data

1 Who We Are

This Privacy Policy applies to the Luky22 online gaming platform, accessible at luky22.win. When this policy refers to "Luky22", "we", "us", or "our", it means the operator of the luky22.win platform. When it refers to "you" or "your", it means you as a registered player or visitor to the platform.

Luky22 is the data controller for personal data collected through this platform. That means we are responsible for deciding what data is collected, how it is used, and how it is stored. If you have any questions or concerns about how your personal data is handled, you can contact our support team using the details at the end of this policy.

This policy applies to all personal data collected when you visit luky22.win, register an account, make a deposit or withdrawal, place bets, play games, contact support, or interact with the platform in any other way. It does not cover third-party websites that may be linked from our platform.

2 Personal Data We Collect

The types of personal data Luky22 may collect are grouped below by category:

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, biometric data (beyond what is strictly necessary for identity verification), or medical information, unless specifically required for responsible gaming purposes and only with your knowledge.

3 How We Collect Your Data

Data reaches us through three main routes:

• Directly from you — when you complete the registration form, submit identity verification documents, make a deposit or withdrawal, contact support, or adjust your account settings. This is the primary route for most personal data.
• Automatically — as you use the platform, we collect technical data including your IP address, device type, operating system, browser version, pages visited, games opened, and session timestamps. This data is collected through server logs and session management tools.
• From third-party service providers — our payment processors confirm transaction status and reference numbers; identity verification partners return verification results; fraud detection tools flag risk signals. We receive outputs from these services rather than raw personal data where possible.

4 Why We Use Your Data

Every use of your personal data at Luky22 has a defined purpose. The main purposes are:

• Account management — creating and maintaining your player account, processing your login, and linking your bets and transactions to your profile.
• Processing payments — handling PKR deposits via JazzCash, Easypaisa, Raast, Bank Transfer, and cards; processing withdrawal requests back to your registered payment method.
• Identity verification (KYC) — confirming your identity and age to comply with age verification obligations and to protect against fraud. This involves checking the documents you submit against the information provided at registration.
• Fraud prevention and security — monitoring account activity for signs of unauthorised access, bonus abuse, money laundering, and other prohibited conduct. Automated and manual checks are used.
• Responsible gaming — using your account history and self-reported preferences to apply deposit limits, session reminders, and self-exclusion settings correctly, and to identify accounts that may show signs of problematic gambling behaviour.
• Customer support — responding to your queries, resolving disputes, and maintaining records of communications for quality assurance and dispute resolution.
• Platform improvement — analysing anonymised usage patterns to understand which features are used most, where players encounter problems, and how the platform can be improved.
• Legal and regulatory compliance — meeting our obligations to retain financial transaction records and respond to legitimate requests from law enforcement or legal authorities.

5 Legal Basis for Processing

For each category of personal data processing, there is a legal basis that justifies it. The principal bases we rely on are:

• Contract performance — most processing related to running your account, handling deposits and withdrawals, and delivering the gaming services you signed up for is necessary to fulfil the contract between you and Luky22.
• Legal obligation — identity verification, financial record keeping, and responding to law enforcement requests are carried out because we are required to do so, not solely by choice.
• Legitimate interests — fraud prevention, security monitoring, platform analytics, and responsible gaming monitoring are carried out on the basis of our legitimate interest in operating a safe and well-functioning platform, balanced against your privacy rights.
• Consent — where we rely on your consent for a specific processing activity, you will be informed and given a clear opportunity to consent or decline. You can withdraw consent at any time without affecting activities already completed.

6 Data Sharing with Third Parties

Luky22 does not sell your personal data to third parties. Sharing occurs only in the following circumstances, and is limited to what the recipient needs for their specific function:

• Payment processors — JazzCash, Easypaisa, Raast, and banking partners receive the transaction details necessary to process your deposit or withdrawal. They operate under their own privacy policies and applicable financial regulations.
• Identity verification providers — when you submit KYC documents, these are processed by a third-party verification service that checks them against your registration details and returns a result. The raw documents are not retained by Luky22 beyond the verification process.
• Game providers — slot and live casino game providers receive a session token and your bet amount to run the game. They do not receive your full account profile, contact details, or payment information.
• Fraud detection services — technical data including IP address, device fingerprint, and behavioural signals may be shared with fraud detection tools to assess risk levels on your account.
• Legal authorities — we will share information with law enforcement, financial regulators, or courts when required by a valid legal order or when we reasonably believe disclosure is necessary to prevent serious harm or crime.

7 Payment Data & KYC Verification

Because Luky22 processes real-money transactions in PKR, we take payment data handling and identity verification with particular seriousness. Here is how it works in practice:

• Full card numbers are never stored on Luky22 servers. Card transactions are tokenised — we store a reference token that allows future transactions, not the underlying card data.
• JazzCash and Easypaisa transaction references are stored in your account history along with PKR amounts and timestamps. This is necessary for dispute resolution and financial record keeping.
• Identity documents (CNIC scans, selfies, statements) submitted for KYC are stored securely and access is restricted to staff involved in the verification process. Once verification is complete, documents are retained only for the period required by financial regulations.
• If a withdrawal is requested, identity verification must be complete. This protects you — it prevents someone else from withdrawing funds from your account using different payment credentials.

We apply the same care to Raast and Bank Transfer details. Bank account numbers shared for withdrawal purposes are stored in encrypted format and access is logged.

8 Cookies & Tracking Technologies

Luky22 uses cookies and similar technologies on its platform. Cookies are small text files stored on your device that help the platform recognise you between sessions and function correctly. Here is how we use them:

• Essential cookies — required for the platform to work at all. These manage your login session, maintain your account state during play, and enable the shopping basket equivalent (bet slip) in sports betting. These cannot be disabled without breaking the platform.
• Preference cookies — remember your settings such as language preference, lobby filter choices, and notification preferences. These improve your experience but are not strictly necessary.
• Analytics cookies — track anonymised usage patterns such as which pages are visited most, where users drop off, and which game categories see the most engagement. This data is used internally to improve the platform and is not linked to individual player profiles for advertising purposes.

We do not use third-party advertising or remarketing cookies. We do not use pixel tracking from social media platforms.

Most browsers allow you to control cookies through their settings. Blocking essential cookies will likely prevent you from logging in or using the platform correctly. Preference and analytics cookies can generally be blocked without affecting core functionality.

9 How We Protect Your Data

Luky22 takes data security seriously. The following measures are in place to protect your personal data against unauthorised access, loss, or disclosure:

• TLS (Transport Layer Security) encryption is applied to all data in transit between your device and our servers.
• Sensitive data fields — including passwords, payment references, and identity document content — are stored in encrypted or hashed form. Plain-text passwords are never stored.
• Access to personal data within the Luky22 team is role-based. Staff members can only access the data necessary for their specific function, and access events are logged.
• Our servers and databases are hosted in environments with physical and network security controls, including firewalls, intrusion detection, and regular security assessments.
• We monitor for unusual access patterns and anomalous account activity as part of our fraud detection processes, which also serve as a data security function.

10 How Long We Keep Your Data

We do not hold personal data for longer than is necessary. The retention periods below reflect operational needs and legal obligations:

• Active account data — retained for the full duration your account is active. If you have not logged in for an extended period, we may contact you before treating the account as dormant.
• Financial transaction records — retained for a minimum of five years after the transaction date to comply with financial record-keeping obligations. This includes PKR deposit and withdrawal history regardless of account status.
• Identity verification documents — retained for the period required by applicable regulations following account closure, typically five years. After this period they are securely deleted.
• Support communications — retained for three years from the date of the most recent interaction to support dispute resolution and service quality review.
• Self-exclusion records — retained indefinitely to prevent re-registration during or after an exclusion period.
• Usage and analytics data — anonymised aggregates are retained indefinitely. Data linked to your account is deleted when your account data is deleted following the applicable retention period.

When data is no longer needed and the retention period has expired, it is permanently deleted or irreversibly anonymised.

11 Your Rights Over Your Personal Data

You have a number of rights in relation to the personal data Luky22 holds about you. These are described below, along with how to exercise them:

• Access — you can request a copy of the personal data we hold about you. We will provide this within a reasonable timeframe, typically within 30 days of a verified request.
• Rectification — if the data we hold about you is inaccurate or incomplete, you can ask us to correct it. Contact details can be updated directly in your account settings; other data requires a support request.
• Erasure — you can ask us to delete your personal data. We will do so where there is no legal or contractual obligation to retain it. Financial transaction records and KYC data are subject to mandatory retention periods and cannot be deleted before those periods expire.
• Restrict processing — in certain circumstances you can ask us to pause processing of your data while a dispute or review is ongoing, without deleting the data.
• Object — where processing is based on legitimate interests, you have the right to object. We will assess whether our legitimate interest overrides your objection on a case-by-case basis.

To exercise any of these rights, contact Luky22 support with your full name, registered email address, and a description of your request. We may need to verify your identity before actioning the request.

12 Children's Privacy

Luky22 is strictly for adults aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you are under 18, you must not use this platform, register an account, or provide any personal data.

If we become aware that an account belongs to or is being used by a person under 18, that account will be closed immediately, all activity will be voided, and any deposited funds will be returned to the payment source after appropriate checks.

If you are a parent or guardian and believe a minor may have registered on Luky22, please contact our support team immediately with the account details so we can investigate and act promptly.

13 Changes to This Privacy Policy

Luky22 may update this Privacy Policy from time to time to reflect changes in how the platform operates, changes in applicable legal requirements, or improvements in how we protect and manage your data.

When material changes are made, the "last reviewed" date at the top of this page will be updated. For significant changes that affect your rights or how your data is used, we will also notify you via your registered email address or through an in-platform notification when you next log in.

Continuing to use Luky22 after a revised Privacy Policy has been published and you have been notified constitutes your acceptance of the updated policy. If you disagree with changes to the policy, you should contact support to discuss your options, which may include account closure.

We recommend revisiting this page periodically, particularly after receiving a notification about an update, to stay informed about how your personal data is being handled.

14 Contact Us About Privacy

If you have questions about this Privacy Policy, want to exercise any of your data rights, or have a concern about how your personal data has been handled, please reach out to us:

• Live Chat: Available within the platform after logging in. Ideal for quick questions and initial reports.
• Email: [email protected] — for formal data rights requests or detailed privacy concerns, email is recommended so you have a written record.

When contacting us about a data request, please include your full name as registered on your account and the email address associated with it. This helps us verify your identity and action your request correctly.

We aim to respond to all privacy-related requests within 30 calendar days. Complex requests or those requiring additional verification may take longer, in which case we will keep you updated on progress.