Privacy Policy – lukcy8 Player Data Protection Pakistan

1 Who We Are

lukcy8 ("we," "us," "our") operates the online gaming and sports betting platform available at lukcy8.app. This Privacy Policy applies to all players and visitors who use our website, mobile applications and any associated services.

We act as the data controller for the personal information you provide to us when you register, deposit, play or contact our support team. This means we are responsible for deciding how and why your personal data is processed, and we are accountable for keeping it secure.

This Privacy Policy should be read alongside our Terms and Conditions and our Responsible Gaming policy, both of which form part of the full agreement between you and lukcy8.

2 Data We Collect

We collect only the personal data that is necessary to operate your account and provide our services. The categories of data we collect include:

We do not collect sensitive personal data such as biometric data, health information or religious beliefs. If any additional data category becomes necessary in future, this policy will be updated accordingly.

3 How We Collect Your Data

We collect personal data through the following channels:

• Direct collection: Information you provide when you register an account, complete identity verification, make a deposit or contact our support team.
• Automated collection: Technical and usage data collected automatically when you visit our website or use our app — including IP address, device identifiers, browser type and browsing behaviour through cookies and similar technologies.
• Payment providers: When you deposit or withdraw via JazzCash, Easypaisa, Raast or a bank transfer, our payment processing partners share confirmation and reference data with us to match transactions to your account.
• Identity verification services: If you are asked to verify your identity, a third-party verification provider may share the outcome of that check with us.
• Fraud prevention services: We may receive risk signals from anti-fraud providers that help us identify suspicious account activity before it affects you.

4 How We Use Your Data

We process your personal data only for specific, legitimate purposes. The main reasons we use your data are:

• Operating your account: Creating and maintaining your account, processing your deposits and withdrawals in PKR, and keeping a record of your betting and gaming activity.
• Identity and age verification: Confirming that you are 18 or older and that your account details are genuine. This is a fundamental requirement for operating a responsible gaming platform.
• Fraud prevention and security: Detecting and investigating suspicious activity, protecting your account from unauthorised access, and preventing money laundering.
• Customer support: Responding to your queries, resolving disputes and processing complaints.
• Responsible gaming: Monitoring your activity patterns to identify potential problem gaming behaviour and providing tools such as deposit limits and self-exclusion when needed.
• Platform improvement: Analysing aggregated usage data to improve how the platform works, fix bugs and develop new features.
• Marketing communications: Sending you relevant offers and promotions by email or push notification — but only if you have opted in to receive them. You can opt out at any time from your account settings.
• Legal compliance: Meeting our obligations under applicable laws including anti-money laundering requirements.

5 Who We Share Your Data With

We do not sell your personal data to third parties. We share your data only in the following limited circumstances and only to the extent necessary for the stated purpose:

• Payment processors: JazzCash, Easypaisa, Raast, bank partners and card processors receive the transaction data required to execute your deposit or withdrawal. These providers operate under their own privacy policies and are independently responsible for their data handling.
• Identity verification providers: When you submit documents for account verification, a specialist third-party service processes those documents and returns a pass or fail result to us. We do not store your raw document images longer than necessary.
• Fraud and security providers: We share technical and behavioural data with anti-fraud services to help identify compromised accounts and suspicious patterns.
• Customer support platforms: Our support tools may be operated by third-party service providers who process chat and email data on our behalf under strict data processing agreements.
• Legal authorities: We may disclose personal data when required to do so by law, court order or a legitimate request from a law enforcement authority. We will notify you of any such disclosure to the extent permitted by law.
• Business transfers: If lukcy8 is involved in a merger, acquisition or asset sale, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

6 Payment Data & Financial Privacy

Financial data requires a higher level of care, and we treat it accordingly. Here is how we handle payment-related information on lukcy8:

• Full card numbers and mobile wallet PINs are never stored on our servers. Payment processing is handled by PCI-DSS compliant third-party processors.
• We retain a record of transaction amounts, dates, payment method types and reference numbers for account management and anti-money laundering compliance.
• All PKR transaction data is encrypted both in transit and at rest.
• When you make a withdrawal via JazzCash or Easypaisa, only the minimum data required to route the payment to your registered mobile number is shared with the provider.
• For Raast and bank transfer withdrawals, your account name and bank account number are shared only with your nominated bank to process the transfer.

If you believe there has been an unauthorised transaction on your account, contact support immediately. We will freeze your account pending investigation to prevent further transactions.

7 Cookies & Tracking Technologies

lukcy8 uses cookies and similar technologies to make the platform work correctly and to understand how players use it. A cookie is a small text file placed on your device by your browser when you visit our site.

We use the following types of cookies:

• Essential cookies: Required for the platform to function — keeping you logged in, maintaining your session state and enabling secure transactions. These cannot be disabled without breaking the platform.
• Analytics cookies: Help us understand which pages are visited most frequently, how long players stay on the platform and where errors occur. This data is aggregated and does not identify individual players.
• Preference cookies: Remember your settings such as language preferences and display options so you do not have to reset them on every visit.
• Security cookies: Used to detect suspicious activity, prevent fraudulent logins and protect your account.

You can manage or delete cookies through your browser settings at any time. Please note that disabling essential cookies will affect the functionality of the platform and you may not be able to log in or place bets.

8 How Long We Keep Your Data

We retain personal data only for as long as it is needed for the purpose it was collected, or as required by applicable law. Our general retention periods are as follows:

• Active account data: Retained for the full duration of your account and for a period of five years after account closure, primarily to meet anti-money laundering record-keeping requirements.
• Transaction records: Financial transaction data is retained for a minimum of five years from the date of the transaction.
• Identity verification documents: Retained for the period required by applicable law and deleted securely thereafter.
• Support communications: Chat logs and email correspondence are retained for two years from the date of the last interaction.
• Marketing data: If you have opted in to marketing communications, your contact details are retained until you opt out, after which they are removed from our marketing lists within 30 days.
• Inactive accounts: Accounts with no login activity for 12 months are flagged as inactive. We will contact you before taking any action. Data from inactive accounts is subject to the same retention rules as active accounts.

When data is no longer required, it is either securely deleted or anonymised so that it can no longer be linked to you as an individual.

9 Data Security

We take the security of your personal data seriously and have put in place technical and organisational measures to protect it against unauthorised access, loss, alteration or disclosure. Our security practices include:

• All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security).
• Sensitive data at rest — including financial records and identity data — is encrypted using industry-standard encryption algorithms.
• Access to personal data within our organisation is restricted on a need-to-know basis. Staff who handle player data receive data protection training.
• We conduct regular security assessments and penetration testing to identify and remediate vulnerabilities.
• Two-factor authentication is available for your account and we strongly recommend enabling it to protect your login.
• Our payment processing partners are PCI-DSS certified, ensuring that your card and mobile wallet data meets the highest industry security standards.

10 Your Rights Over Your Data

As a player on lukcy8, you have the following rights in relation to your personal data. To exercise any of these rights, contact our support team with your account details and a clear description of your request.

We will respond to all data rights requests as promptly as possible. We may need to verify your identity before fulfilling a request to protect against unauthorised access to account data.

11 Minors & Age Policy

lukcy8 is strictly an adult platform. We do not knowingly collect or process personal data from individuals under the age of 18. All players are required to confirm their age during registration, and we may request identity verification at any time to confirm that a player meets the minimum age requirement.

If we discover that an account has been registered by or on behalf of a person under 18, we will immediately close the account, forfeit any balance and delete the associated personal data as soon as legally permissible.

If you are a parent or guardian and believe that a minor has registered on lukcy8 without your knowledge, please contact our support team immediately with relevant details so we can investigate and take appropriate action.

12 Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, new services, legal requirements or feedback from our players. When we make material changes, we will notify you by email to your registered address or through an in-platform notification.

The updated policy will take effect from the date shown at the top of this page. Continuing to use lukcy8 after that date means you accept the updated policy. If you do not agree with the changes, you should close your account before they take effect.

Minor updates — such as correcting a typo or clarifying an existing point without changing its meaning — may be made without a formal notification. We encourage you to review this page periodically to stay informed.

13 Contact Us

If you have any questions about this Privacy Policy, want to exercise any of your data rights, or need to report a potential data security issue, please get in touch with our team. We are available 24 hours a day, 7 days a week via live chat on the platform.

You can also reach us by email at:

[email protected]

When contacting us about a data rights request, please include your registered username and a description of your request so our team can locate your account and respond efficiently. We aim to acknowledge all data-related enquiries within two business days.