luky22 Privacy
Policy

This Privacy Policy ("Policy") is published by luky22 ("luky22", "we", "us", "our"), the operator of the online gaming platform accessible at luky22.org. This Policy describes how luky22 collects, uses, stores, shares, and protects the personal data of individuals ("you", "Player", "User") who access or use the luky22 website, mobile-optimised platform, or any associated services.

luky22 serves players primarily across Pakistan — from Karachi and Lahore to Islamabad, Faisalabad, and beyond — and is operated in accordance with internationally recognised data protection principles. While Pakistan is the primary market for luky22, our data protection practices are aligned with globally accepted privacy frameworks, including the General Data Protection Regulation (GDPR) principles, to ensure the highest standard of data handling for all users.

This Policy applies to all personal data processed by luky22 in connection with the operation of the platform, including data collected through account registration, financial transactions, customer support interactions, gameplay activity, and your use of the luky22 website generally. This Policy should be read alongside our Terms & Conditions and our Responsible Gaming Policy, both of which form part of your agreement with luky22.

luky22 collects personal data through several channels, including your account registration form, your ongoing use of the platform, payment processing, identity verification, and your communications with our support team. The categories of personal data we may collect include the following:

luky22 uses your personal data only for legitimate, clearly defined purposes. We do not use your data in ways that are incompatible with the purposes for which it was originally collected. The primary purposes for which luky22 processes personal data are as follows:

• Account Management: To create, maintain, and administer your luky22 player account, including processing your registration, managing your profile, and communicating account-related notifications.
• Identity & Age Verification: To verify that you are aged 21 or above and that your identity matches the information provided during registration, in compliance with our regulatory obligations.
• Transaction Processing: To process deposits and withdrawals in PKR via JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, and other supported payment methods, and to maintain accurate transaction records.
• Fraud Prevention & Security: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, multi-accounting, and other prohibited behaviours on the luky22 platform.
• Regulatory Compliance: To fulfil our obligations under applicable gaming regulations and international anti-money laundering (AML) and counter-terrorism financing (CTF) frameworks, including the retention of transaction and player records as required by law.
• Customer Support: To respond to your queries, resolve disputes, process complaints, and provide assistance through live chat and email support channels.
• Responsible Gaming: To monitor player behaviour for signs of problem gambling, to administer responsible gaming tools (deposit limits, self-exclusion, cool-off periods), and to intervene where a player may be at risk.
• Platform Improvement: To analyse aggregated usage data in order to improve the performance, content, and user experience of the luky22 platform.
• Marketing Communications: To send you promotional offers, bonus notifications, and news about luky22 products and features, where you have consented to receive such communications. You may withdraw your marketing consent at any time by contacting our support team.

luky22 processes personal data only where a valid legal basis exists for doing so. In accordance with internationally recognised data protection principles, the legal bases upon which luky22 relies are:

• Contractual Necessity: Processing is necessary for luky22 to perform the contract it has with you — i.e., to operate your player account, process your transactions, and deliver gaming services.
• Legal Obligation: Processing is required to comply with applicable laws and regulatory requirements, including KYC, AML, and responsible gaming obligations imposed by luky22's licensing framework.
• Legitimate Interests: Processing is carried out for the legitimate interests of luky22, including fraud detection, platform security, and business analytics, provided those interests are not overridden by your fundamental rights.
• Consent: Where luky22 relies on your consent as the legal basis for processing — for example, for marketing communications or the use of non-essential cookies — you may withdraw that consent at any time without affecting the lawfulness of processing that took place prior to withdrawal.

luky22 may share your personal data with the following categories of third parties, solely to the extent necessary for the purposes described in this Policy:

• Payment Service Providers: JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, and 1LINK, for the sole purpose of processing your deposits and withdrawals in PKR. These providers process your financial data under their own privacy policies and are bound by applicable financial regulations.
• Identity Verification Partners: Third-party KYC and AML compliance service providers engaged by luky22 to verify player identities, confirm age eligibility, and screen against sanctions and politically exposed persons (PEP) lists.
• Gaming Software Providers: Game studios and platform technology providers who power the luky22 casino, sportsbook, and live dealer products. These providers receive only the technical and gameplay data necessary to deliver their services.
• Regulatory Authorities: luky22 may be required to disclose player data to its licensing authority or other competent regulatory bodies in response to lawful requests, audits, or investigations.
• Law Enforcement & Legal Proceedings: luky22 may disclose personal data where required by law, court order, or to protect the rights, property, or safety of luky22, its players, or the public.
• IT Infrastructure & Security Providers: Cloud hosting, cybersecurity, and platform infrastructure partners who process data on behalf of luky22 under strict data processing agreements.

All third parties with whom luky22 shares personal data are contractually required to process that data only in accordance with luky22's instructions and applicable data protection standards. luky22 does not permit third parties to use your personal data for their own marketing or commercial purposes.

The luky22 platform uses cookies and similar tracking technologies to enhance your browsing experience, maintain your login session, remember your preferences, and collect aggregated analytics data. A cookie is a small text file placed on your device when you visit the luky22 website.

• Essential Cookies: These are strictly necessary for the luky22 platform to function correctly. They enable core features such as user authentication, session management, and security. Essential cookies cannot be disabled without impairing your ability to use the platform.
• Analytics Cookies: These cookies allow luky22 to understand how players interact with the platform — which pages are most visited, how long sessions last, and where players encounter difficulties. This data is aggregated and anonymised and is used solely to improve the platform.
• Functional Cookies: These cookies remember your preferences — such as your chosen language, display settings, and responsible gaming tool configurations — so that you do not need to re-enter them on each visit.
• Marketing Cookies: Subject to your consent, luky22 may use marketing cookies to deliver relevant promotional content and to measure the effectiveness of our marketing campaigns. You may withdraw your consent to marketing cookies at any time via the cookie settings panel.

You can manage your cookie preferences at any time through your browser settings. Please note that disabling certain categories of cookies may affect the functionality of the luky22 platform.

luky22 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulatory obligations. The following retention periods apply as a general guide:

• Active Account Data: Personal data associated with your active luky22 account is retained for the full duration of your account's active status and for a minimum of five (5) years following account closure, in compliance with AML and gaming regulatory record-keeping requirements.
• Transaction Records: Financial transaction data, including deposit and withdrawal records in PKR, is retained for a minimum of five (5) years from the date of the transaction, as required under applicable financial regulations.
• KYC Documentation: Identity verification documents (including CNIC scans) are retained for five (5) years following account closure or the conclusion of any regulatory investigation, whichever is later.
• Support Communications: Customer support interactions are retained for three (3) years from the date of the interaction, to enable luky22 to handle any subsequent disputes or complaints.
• Marketing Data: Where processing is based on consent, marketing data is retained until you withdraw your consent. Following withdrawal of consent, marketing communications will cease within a reasonable period and your marketing preferences will be updated accordingly.

Upon expiry of the applicable retention period, luky22 will securely delete or anonymise your personal data in accordance with our data destruction procedures. Anonymised data may be retained indefinitely for statistical and analytical purposes.

luky22 takes the security of your personal data extremely seriously and has implemented a comprehensive suite of technical and organisational security measures to protect your information against unauthorised access, accidental loss, disclosure, alteration, or destruction.

• 256-Bit SSL Encryption: All data transmitted between your device and the luky22 platform is encrypted using industry-standard 256-bit SSL/TLS technology. This ensures that your personal and financial data cannot be intercepted during transmission.
• Two-Factor Authentication (2FA): luky22 supports two-factor authentication on all player accounts. We strongly encourage all players to activate 2FA for an additional layer of account security.
• Secure Data Storage: All personal data is stored on secure, access-controlled servers. Access to personal data is restricted to authorised luky22 personnel on a strict need-to-know basis.
• Real-Time Fraud Monitoring: luky22 operates continuous, automated fraud detection and monitoring systems that analyse platform activity in real time to identify and respond to suspicious behaviour.
• Regular Security Audits: luky22 conducts regular internal and third-party security audits and penetration testing to identify and remediate vulnerabilities in our platform infrastructure.
• Staff Training: All luky22 personnel with access to personal data receive mandatory data protection training and are bound by confidentiality obligations.

As a luky22 player, you have the following rights with respect to your personal data. luky22 is committed to upholding these rights and will respond to all valid requests within a reasonable timeframe, and no later than thirty (30) days from the date of receipt.

• Right of Access: You have the right to request a copy of the personal data that luky22 holds about you, along with information about how it is being processed.
• Right to Rectification: If any personal data that luky22 holds about you is inaccurate or incomplete, you have the right to request that it be corrected or updated.
• Right to Erasure: In certain circumstances, you have the right to request that luky22 delete your personal data. Please note that this right is subject to our regulatory data retention obligations, which may require luky22 to retain certain data for a specified minimum period.
• Right to Restriction of Processing: You have the right to request that luky22 restrict the processing of your personal data in certain circumstances, for example while the accuracy of the data is being contested.
• Right to Data Portability: Where processing is based on your consent or on the performance of a contract, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where luky22 relies on legitimate interests as the legal basis. You also have the right to object to the processing of your data for direct marketing purposes at any time.
• Right to Withdraw Consent: Where luky22 processes your data based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to the withdrawal.

To exercise any of the above rights, please contact the luky22 Data Protection team by email at [email protected]. Please include your registered username and a clear description of the right you wish to exercise. We may need to verify your identity before processing your request.

luky22 takes its age verification obligations extremely seriously. All new registrations are subject to mandatory age and identity verification via our KYC process, which requires submission of a valid Computerised National Identity Card (CNIC) or other acceptable government-issued identification. Any account found to belong to an individual under the age of 21 will be immediately suspended, all funds will be frozen, and the matter will be escalated in accordance with our regulatory obligations.

If you have reason to believe that a minor has registered on the luky22 platform, please contact our support team immediately at [email protected]. We will investigate and take appropriate action without delay.

As an internationally operated gaming platform, luky22 may transfer your personal data to countries outside Pakistan in connection with the operation of our platform, the delivery of gaming services, or the fulfilment of regulatory requirements. Such transfers may involve our game software providers, cloud hosting infrastructure partners, and KYC verification service providers, who may be located in various jurisdictions globally.

Wherever personal data is transferred internationally, luky22 ensures that appropriate safeguards are in place to protect your information. These safeguards may include contractual clauses requiring the recipient to protect personal data to a standard equivalent to that applied by luky22, or reliance on the recipient's adherence to internationally recognised data protection frameworks.

luky22 reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or platform functionality. The most current version of this Policy will always be accessible on the luky22 website at luky22.org/privacy-policy, with the effective date clearly displayed at the top of the document.

Where changes to this Policy are material — for example, where we introduce a new category of data processing or change the basis on which we share data with third parties — luky22 will provide advance notice via a platform notification or by email to your registered address. Your continued use of the luky22 platform following any such amendment constitutes your acknowledgement of the updated Policy.

If you have any questions, concerns, or requests relating to this Privacy Policy, or if you wish to exercise any of your data rights, please contact the luky22 Data Protection team. We are available 24/7 via live chat on the platform or by email.

For general support queries — including account issues, payment questions, or responsible gaming assistance — our 24/7 live chat team is always on hand to help players from Karachi, Lahore, Islamabad, Faisalabad, and across Pakistan.