Lucky33 Privacy Policy — How We Protect Your Data in Pakistan

1 Who We Are

This Privacy Policy applies to the Lucky33 online gaming platform accessible at lucky33.cash. When this policy refers to "Lucky33", "we", "us" or "our", it refers to the operator of the Lucky33 platform. Lucky33 is the data controller responsible for the personal data collected from players who register and use the platform.

Lucky33 is built specifically for Pakistani players and processes all personal data in accordance with the obligations applicable to its operations. If you have any questions about how Lucky33 handles your data, you can reach the privacy team at support@lucky33.cash or via live chat at any time.

By creating an account on Lucky33 or continuing to use the platform after this policy has been updated, you confirm that you have read and understood how your personal data will be handled. This policy should be read alongside Lucky33's Terms and Conditions, which govern the broader relationship between you and the platform.

2 Data We Collect

Lucky33 collects personal data in three main ways: data you provide directly during registration and account use, data generated automatically through your interaction with the platform, and data received from third parties such as payment processors and identity verification services.

2.1 Data You Provide Directly

2.2 Data Collected Automatically

• Device & technical data: IP address, device type and model, operating system, browser type and version, screen resolution.
• Usage data: Pages visited on Lucky33, games played, bets placed, time spent on each section, click patterns and navigation paths.
• Session data: Login timestamps, session duration, logout events, failed login attempts.
• Transaction data: Deposit amounts, withdrawal requests, bet history, win/loss records, bonus redemption history.
• Location data: General geographic location inferred from your IP address (city-level only — Lucky33 does not collect GPS location data).

2.3 Data from Third Parties

Lucky33 receives data from payment processors (confirmation of successful transactions), identity verification providers (confirmation of document authenticity), and fraud prevention services (risk signals associated with your device or behaviour patterns).

3 How We Use Your Data

Lucky33 uses your personal data for the following purposes:

• Account management: Creating and maintaining your Lucky33 account, authenticating your identity when you log in, and providing access to all platform features.
• Payment processing: Processing deposits and withdrawals in PKR, verifying payment method ownership, and maintaining transaction records.
• KYC and compliance: Verifying your identity and age to comply with anti-money laundering, fraud prevention, and responsible gambling obligations.
• Customer support: Responding to your queries, resolving account issues, and maintaining records of support interactions for quality and training purposes.
• Platform improvement: Analysing usage patterns to improve Lucky33's interface, game selection, and performance. This analysis is conducted on aggregated, anonymised data wherever possible.
• Responsible gaming: Monitoring account activity for patterns consistent with problem gambling behaviour and intervening when appropriate, including contacting players who appear to be at risk.
• Fraud prevention: Detecting and preventing fraudulent activity, bonus abuse, and unauthorised account access.
• Marketing communications: Sending you information about Lucky33 promotions and offers that may be relevant to your gaming activity, where you have consented to receive such communications or where Lucky33 has a legitimate interest in doing so.
• Legal obligations: Complying with applicable laws, responding to lawful requests from regulatory and law enforcement authorities, and maintaining records as required by applicable regulations.

4 Legal Bases for Processing

Lucky33 processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to perform the contract between you and Lucky33— this covers account management, payment processing, game access, and customer support.
• Legal obligation: Processing required to comply with applicable legal requirements including KYC/AML obligations, age verification, and record-keeping requirements.
• Legitimate interests: Processing carried out for Lucky33's legitimate business interests where those interests are not overridden by your privacy rights — this covers fraud prevention, platform security, and performance analytics.
• Consent: Processing based on your explicit consent — primarily for marketing communications. You can withdraw consent for marketing at any time by updating your communication preferences in your Lucky33 account settings.

5 Who We Share Data With

Lucky33 shares your personal data only with the categories of recipients described below, and only to the extent necessary for the stated purpose. Lucky33 does not sell or commercially transfer your personal data to any third party.

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay, and banking partners require transaction data to process deposits and withdrawals. These providers process data under their own privacy policies and are contractually bound to use data only for the purpose of processing your transactions.
• Identity verification providers: Third-party KYC services that assist Lucky33 in verifying the authenticity of identity documents. These providers are contractually bound to strict data handling standards.
• Fraud prevention services: Data sharing with fraud detection platforms for the purpose of identifying and preventing fraudulent activity. These services receive minimal data (typically device fingerprint signals and transaction risk flags) and are not permitted to use the data for any other purpose.
• Technology providers: Cloud hosting, content delivery, and platform infrastructure providers who process data on Lucky33's behalf under data processing agreements that require them to handle data in accordance with Lucky33's instructions.
• Regulatory and law enforcement authorities: Lucky33 will disclose personal data in response to a lawful request from a competent authority, court order, or as required to comply with applicable law. Lucky33 will notify you of any such disclosure where legally permitted to do so.
• Professional advisors: Legal counsel, auditors, and compliance consultants who may access data as part of their professional engagement with Lucky33, subject to professional confidentiality obligations.

6 Payment Data

Given that Lucky33 operates exclusively in PKR and serves Pakistani players, payment data handling is designed around the local payment ecosystem. Here is exactly what Lucky33 stores and what it does not:

6.1 What Lucky33 Stores

• Your registered mobile number associated with Easypaisa or JazzCash (for withdrawal processing).
• Transaction reference numbers from payment providers.
• Deposit and withdrawal amounts, timestamps, and status records.
• The last four digits of bank card numbers used for card payments (full card numbers are never stored on Lucky33's systems).
• IBAN numbers for IBFT bank transfers (stored in encrypted form).

6.2 What Lucky33 Does Not Store

• Your Easypaisa or JazzCash PIN or password.
• Full bank card numbers, CVV codes, or card expiry dates.
• Online banking credentials for any financial institution.
• Any payment credential that would allow Lucky33 to initiate a transaction from your payment account without your explicit action.

Card payments processed through Lucky33 are handled by PCI-DSS compliant payment processors. Lucky33 never directly handles full card data — it passes through the processor's secure environment without being stored on Lucky33's infrastructure.

7 Cookies & Tracking Technologies

Lucky33 uses cookies and similar technologies (local storage, session storage) to operate the platform and understand how players use it. Below is a breakdown of the cookie categories Lucky33 uses:

You can control cookies through your browser settings. Note that disabling essential cookies will prevent Lucky33 from functioning correctly — you will not be able to log in or place bets if session cookies are blocked. Disabling analytics and preference cookies will not affect core platform functionality.

8 Data Security

Lucky33 takes the security of your personal data seriously and implements a layered approach to protection:

• Encryption in transit: All data transmitted between your browser or device and Lucky33's servers uses TLS 1.3 encryption. Any attempt to intercept data in transit would encounter encrypted content that cannot be read without the decryption key.
• Encryption at rest: Sensitive personal data including CNIC information, IBAN numbers, and identity verification records are stored in encrypted form on Lucky33's servers. Encryption keys are managed separately from the encrypted data.
• Access controls: Access to personal data within Lucky33's systems is restricted to staff members who require it for their specific role. Access logs are maintained and reviewed regularly. Administrative access requires multi-factor authentication.
• Infrastructure security: Lucky33's infrastructure is hosted on servers with physical security controls, network firewalls, intrusion detection systems, and regular security audits.
• Incident response: Lucky33 maintains a data breach response plan. In the event of a data breach that poses a risk to your rights, Lucky33 will notify affected players and relevant authorities within the timescales required by applicable law.

No security system is completely impenetrable, and Lucky33 cannot guarantee that your data will be completely secure in all circumstances. However, Lucky33 applies industry-standard security measures appropriate to the sensitivity of the data it processes and reviews these measures regularly. Your own device security also plays a role — using a strong unique password for your Lucky33 account and keeping your device's operating system and browser updated significantly reduces your risk.

9 Data Retention

Lucky33 retains your personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable legal obligations. The general retention approach is as follows:

• Active account data: Retained for the duration of your Lucky33 account relationship plus a period after closure as described below.
• Post-closure retention: After account closure, Lucky33 retains identity, KYC, and transaction records for a minimum of 5 years to comply with anti-money laundering and financial record-keeping obligations. This period may be extended if there is an ongoing legal matter, investigation, or dispute related to your account.
• Support communications: Support chat and email records are retained for 2 years from the date of the interaction.
• Analytics data: Aggregated and anonymised analytics data (from which you cannot be identified) may be retained indefinitely for platform improvement purposes.
• Marketing consent records: Records of your consent to receive marketing communications are retained for as long as you have an active account and for 2 years following account closure, to demonstrate compliance with applicable rules.

10 Your Rights Over Your Data

As a Lucky33 player, you have the following rights regarding your personal data. Lucky33 will respond to any rights request within 30 days of receipt. Requests can be submitted by contacting support@lucky33.cash or via live chat.

11 Marketing Communications

Lucky33 may send you information about promotions, bonuses, new game categories, and platform updates via SMS, email, or in-platform notifications. By default, Lucky33 may send you communications about offers directly related to games you have played and promotions relevant to your activity on the platform.

You can opt out of all marketing communications at any time by:

• Updating your notification preferences in your Lucky33 account settings (immediate effect).
• Replying STOP to any Lucky33 SMS message (takes effect within 24 hours).
• Contacting Lucky33 support via live chat or email with a request to be removed from marketing lists.

Opting out of marketing communications will not affect transactional communications — Lucky33 will continue to send you notifications about your deposits, withdrawals, bet settlements, account security alerts, and any communications required by law or by your account relationship with Lucky33.

12 Children's Privacy

Lucky33 is strictly for adults aged 18 and over. Lucky33 does not knowingly collect personal data from anyone under the age of 18. The platform's registration process includes an age declaration and date of birth entry, and KYC verification is used to confirm age for accounts flagged as potentially underage.

If Lucky33 discovers that personal data from a person under 18 has been collected — whether through misrepresentation of age at registration or any other means — that data will be deleted immediately, the account will be closed, and any deposited funds will be returned to the source payment method. Parents or guardians who become aware that a minor has created a Lucky33 account should contact support@lucky33.cash immediately for prompt action.

13 Changes to This Privacy Policy

Lucky33 reviews this Privacy Policy regularly and updates it when the platform's data practices change, when new features are introduced that affect data processing, or when regulatory requirements change. The date of the most recent update is shown at the top of this page.

When Lucky33 makes material changes to this policy — changes that significantly affect how your data is used or your rights in relation to it — Lucky33 will notify registered players via email or an in-platform notification at least 7 days before the changes take effect. Non-material changes (corrections, clarifications, updated contact information) may take effect immediately.

Continued use of Lucky33 after the effective date of any policy update constitutes acceptance of the updated Privacy Policy. The current version published at lucky33.cash/privacy-policy is the governing version at any given time.

14 Contact & Complaints

For any question about this Privacy Policy, to exercise your data rights, or to raise a privacy concern, please contact Lucky33 through the following channels:

• Email: support@lucky33.cash — include "Privacy Request" in the subject line to ensure routing to the correct team.
• Live Chat: Available 24 hours a day, 7 days a week via the Lucky33 platform. Average first response under 3 minutes.

Lucky33 will acknowledge your privacy request within 2 business days and will aim to provide a full response within 30 days. Complex requests — such as comprehensive data access requests requiring extraction from multiple systems — may take up to 60 days, in which case Lucky33 will inform you of the extended timeline within the initial 30-day window.

If you are not satisfied with Lucky33's response to a privacy complaint, you have the right to escalate the matter. Lucky33 encourages players to contact the support team first to give the platform the opportunity to resolve the issue directly.