luck98 Privacy
Policy

This Privacy Policy applies to all personal data collected and processed by luck98 in connection with the online betting and gaming services provided at luck98.app and through any related mobile applications, promotional channels, or customer support interfaces operated under the luck98 brand.

For the purposes of this Privacy Policy, luck98 acts as the data controller — meaning we determine the purposes and means by which your personal data is processed. Where luck98 engages third-party service providers to process data on our behalf, those parties act as data processors and are bound by data processing agreements that require them to handle your data only in accordance with our instructions and applicable law.

This Policy is intended to inform players located in Pakistan — including those in Karachi, Lahore, Islamabad, Faisalabad, Rawalpindi, Peshawar, Quetta, and all other cities and regions of Pakistan — of their rights and our obligations regarding personal data.

luck98 collects personal data through several channels: directly from you when you register or interact with our Platform, automatically through technical systems when you use our services, and in limited cases from trusted third-party sources for verification purposes. The categories of data we collect include:

luck98 does not collect special categories of sensitive personal data (such as health data, religious beliefs, or political opinions) except where strictly required by law or where you have provided such information voluntarily in a support context.

luck98 uses the personal data we collect for the following purposes:

• Account creation and management: To register your Account, verify your identity, manage your account settings, and maintain your betting history and balance on the luck98 Platform.
• Service delivery: To process your bets, settle winnings, execute PKR deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other approved payment methods.
• Identity verification (KYC): To verify that you meet the 21+ age requirement, that you are who you say you are, and that funds deposited on luck98 are legitimately sourced, as required by our licensing obligations.
• Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, multi-accounting, bonus abuse, and other conduct that violates the luck98 Terms and Conditions.
• Regulatory compliance: To fulfil obligations under applicable law, including anti-money laundering (AML) regulations, and to respond to lawful requests from regulatory authorities.
• Customer support: To respond to your queries, resolve disputes, and improve the quality of our customer service based on interaction history.
• Platform improvement: To analyse usage patterns, conduct A/B testing, and improve the features, performance, and security of the luck98 Platform.
• Responsible gaming: To monitor betting behaviour for signs of problem gambling and to apply the responsible gaming tools and restrictions you have requested.
• Marketing communications: To send you promotional offers, bonus notifications, and updates about new features on luck98, where you have opted in to receive such communications. See Section 12 for opt-out options.

luck98 relies on the following legal bases to process your personal data, depending on the purpose of the processing:

1. Contractual necessity: Processing is necessary for the performance of the contract between you and luck98 — i.e., to provide betting services, process transactions, and manage your Account.
2. Legal obligation: Processing is necessary to comply with our legal and regulatory obligations, including KYC, AML obligations, and responses to lawful authority requests.
3. Legitimate interests: Processing is necessary for our legitimate interests in preventing fraud, improving Platform security, analysing usage to improve services, and operating our business sustainably — provided these interests are not overridden by your rights.
4. Consent: Where we send you direct marketing communications, we do so only on the basis of your explicit prior consent. You may withdraw this consent at any time.

luck98 does not sell your personal data to third parties. We may, however, share your data with the following categories of recipients where necessary and proportionate:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and approved cryptocurrency processing partners receive the minimum financial data required to execute your deposit and withdrawal transactions.
• Identity verification providers: Third-party KYC and document verification services that assist luck98 in confirming player identities in accordance with our regulatory requirements.
• Fraud prevention services: Specialist third-party tools used to detect and prevent fraudulent activity, multi-accounting, and other violations of the luck98 Terms and Conditions.
• Technology providers: Cloud hosting, database management, and platform infrastructure providers who process data as data processors strictly under our instruction and under binding data processing agreements.
• Regulatory and law enforcement authorities: Where luck98 is required by applicable law, court order, or regulatory direction to disclose your personal data, we will comply with such lawful requests. Where legally permitted, we will notify you of such a request prior to disclosure.
• Professional advisors: Legal, accounting, and audit professionals who are bound by confidentiality obligations and who assist luck98 in its business operations.

luck98 uses cookies and similar tracking technologies on its Platform. A cookie is a small text file placed on your device that helps us recognise you between sessions and deliver a consistent, personalised experience.

The types of cookies used on luck98 include:

• Essential cookies: Strictly necessary for the Platform to function. These include session authentication cookies that keep you logged in and security tokens that protect against cross-site request forgery. These cannot be disabled without breaking Platform functionality.
• Functional cookies: Remember your preferences, such as language settings, odds format, and deposit limit reminders, so you do not need to reconfigure these on each visit.
• Analytics cookies: Collect anonymised data about how Players navigate the luck98 Platform — which pages are most visited, where sessions drop off, and how features are used — to help us improve the product over time.
• Responsible gaming cookies: Store information about the responsible gaming settings you have activated on your Account, including session time limits and cooling-off periods, to ensure these are enforced consistently.

You can manage cookie preferences through your browser settings. However, disabling essential cookies will prevent you from logging in to or using the luck98 Platform. luck98 does not use cookies to track your activity outside of the luck98.app domain.

luck98 retains personal data for as long as is necessary to fulfil the purposes for which it was collected and to comply with applicable legal and regulatory obligations. The following retention periods apply:

• Account data and betting records: Retained for a minimum of 5 years from the date of Account closure, in compliance with standard anti-money laundering record-keeping requirements.
• Financial transaction records: Retained for a minimum of 7 years from the date of each transaction, as required for audit and regulatory purposes.
• KYC identity documents: Retained for the duration of the Account and for a minimum of 5 years following Account closure.
• Customer support communications: Retained for 3 years from the date of last interaction, or longer where a dispute is ongoing.
• Marketing consent records: Retained for the duration of your consent and for 3 years following withdrawal of consent, as evidence of compliance.
• Self-exclusion records: Retained indefinitely to prevent inadvertent Account reactivation in breach of a self-exclusion order.

Once the applicable retention period expires, luck98 will securely delete or anonymise your personal data so that it can no longer be attributed to any identifiable individual.

luck98 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• AES-256 encryption for all data stored at rest on luck98 servers.
• TLS 1.3 encryption for all data transmitted between your device and the luck98 Platform.
• Multi-factor authentication (MFA) for all internal administrative access to production systems.
• Regular independent penetration testing and vulnerability assessments of the luck98 Platform and infrastructure.
• Strict role-based access controls ensuring that luck98 employees can access only the personal data required for their specific job function.
• Comprehensive staff training on data protection obligations and security best practices.
• An incident response plan that specifies the steps to be taken in the event of a suspected data breach, including notification timelines.

luck98 may store and process your personal data on servers located outside of Pakistan. Where your data is transferred internationally, luck98 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to that required under applicable Pakistani data protection principles.

These safeguards may include:

• Contractual clauses in data processing agreements that bind recipient parties to equivalent data protection standards.
• Transfers only to jurisdictions or service providers that have been assessed as providing adequate data protection for the category of data being transferred.
• Encryption of data in transit and at rest, regardless of the jurisdiction in which it is processed.

You may request information about the specific safeguards applied to any international transfer of your personal data by contacting luck98 support at [email protected].

As a luck98 player, you hold the following rights with respect to your personal data. To exercise any of these rights, contact luck98 support via live chat or at [email protected] with a clear description of your request:

1. Right of Access: You have the right to request a copy of all personal data that luck98 holds about you, along with information about how it is being used. luck98 will respond within 30 calendar days.
2. Right to Rectification: You have the right to request that inaccurate or incomplete personal data held by luck98 be corrected or updated. Minor account details such as contact number can be updated directly from within your Account settings.
3. Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent, or where processing is unlawful. Note that this right is subject to legal retention obligations — luck98 cannot delete data we are required by law to retain.
4. Right to Restriction: You have the right to request that luck98 restrict the processing of your personal data in certain circumstances, for example while a correction request is being investigated.
5. Right to Data Portability: You have the right to receive a copy of your personal data in a structured, machine-readable format and to transmit it to another data controller, where technically feasible.
6. Right to Object: You have the right to object to the processing of your personal data where luck98 relies on legitimate interests as its legal basis. You also have an absolute right to object to processing for direct marketing purposes at any time.
7. Right to Withdraw Consent: Where luck98 processes your data on the basis of your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

The luck98 Platform is strictly intended for persons aged 21 and over. luck98 does not knowingly collect, process, or store personal data relating to individuals under the age of 21.

If luck98 discovers or reasonably suspects that personal data has been collected from a person under the age of 21, we will immediately suspend the relevant Account, delete all associated personal data to the extent permitted by law, and void any bets placed by the underage individual.

luck98 employs age verification technology as part of our registration process to identify and prevent access by minors. However, we also rely on the honesty and responsibility of adults in whose care devices are placed to ensure that minors cannot access online betting platforms.

With your prior consent, luck98 may send you promotional communications by SMS, email, or in-app notification. These communications may include bonus offers, free bet promotions, PSL season offers, deposit match campaigns, and Platform feature updates.

You can manage your marketing preferences at any time by:

• Updating your communication preferences directly within your luck98 Account settings under "Notifications".
• Clicking the unsubscribe link included in any marketing email sent by luck98.
• Contacting luck98 support via live chat or email and requesting removal from all marketing lists.

Opting out of marketing communications will not affect your ability to use the luck98 Platform or receive essential service communications related to your Account (such as deposit confirmations, withdrawal notifications, or security alerts — these are not marketing and cannot be opted out of while your Account is active).

luck98 does not use your personal data to build automated marketing profiles based on betting behaviour for sale or licensing to third parties. Personalisation of in-Platform promotions is conducted solely by luck98 using your on-Platform activity data and only for the purpose of improving your experience on luck98.

luck98 is committed to responsible gaming and uses player data to support a safer betting environment. The following explains how your data is used specifically in the context of responsible gaming:

• Behavioural monitoring: luck98 analyses betting patterns, session frequency, deposit frequency, and chasing behaviour to identify players who may be at risk of problem gambling. This analysis is conducted to protect players, not to increase platform revenue.
• Intervention records: Where luck98 contacts a player regarding their gambling behaviour, or where a player triggers a responsible gaming tool, these interactions are recorded and retained to ensure consistency and follow-through in our duty of care obligations.
• Self-exclusion enforcement: Self-exclusion data is retained indefinitely and shared with luck98's account access systems to prevent inadvertent reactivation of excluded accounts. If a player requests removal from a self-exclusion, a 24-hour cooling-off period is enforced regardless of any technical request to the contrary.
• Responsible gaming data sharing: In certain circumstances, luck98 may be required to share responsible gaming data with regulatory bodies or gaming commissions as part of our compliance obligations. This is done only where legally required.

For full information about the responsible gaming tools available on luck98, including deposit limits, loss limits, session reminders, and self-exclusion options, please visit our Responsible Gaming page.

luck98 reserves the right to update or amend this Privacy Policy at any time. Where changes are material — meaning they significantly affect how we process your personal data or the rights available to you — we will provide advance notice via email to your registered address or via a prominent in-Platform notification prior to the changes taking effect.

Minor updates, such as clarifications of existing practices or corrections of typographical errors, may be made without prior notice. The "Last Updated" date at the top of this page will always reflect the date of the most recent revision.

Your continued use of the luck98 Platform following the effective date of any revised Privacy Policy constitutes your acknowledgement of the changes. If you do not accept the revised terms, you should discontinue your use of the Platform and may request Account closure through luck98 support.

Previous versions of this Privacy Policy are available upon written request. Please contact luck98 support and quote the version number or date you require.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or would like to raise a concern about how luck98 handles your personal data, please get in touch through one of the following channels:

• Live Chat: Available 24/7 directly on the luck98 Platform. Average response time under 90 seconds. Support available in both English and Urdu for Pakistani players.
• Email: [email protected] — please include "Privacy Request" in the subject line along with your registered username. Responses to privacy-related email queries are provided within 5 business days and no later than 30 calendar days.

If you are dissatisfied with luck98's response to a privacy concern or data rights request, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction. luck98 will cooperate fully with any regulatory investigation arising from a complaint.

luck98 takes all privacy complaints seriously. Every complaint received is logged, investigated by a qualified member of our compliance team, and responded to in writing. We aim to resolve all privacy complaints fairly and transparently within the 30-day response window.