luckyplay.ph Privacy Policy

1 Introduction

luckyplay.ph ("we," "us," "the Company," or "the Platform") is committed to protecting the privacy and personal data of all individuals who interact with our services. This Privacy Policy describes how luckyplay.ph collects, uses, stores, shares, and protects personal data in connection with the operation of the luckyplay.ph online gaming platform.

This Policy is issued in compliance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and the issuances of the National Privacy Commission (NPC) of the Philippines. It also reflects our obligations under the Anti-Money Laundering Act (AMLA) and PAGCOR's regulatory requirements, which necessitate the collection and retention of certain player data.

We encourage you to read this Privacy Policy carefully and in full. If you have questions about any part of this Policy, please contact our Data Protection Officer using the details provided in Section 14.

2 Data Controller

For the purposes of the Data Privacy Act of 2012, luckyplay.ph is the Personal Information Controller (PIC) in respect of the personal data collected through the luckyplay.ph platform. This means that luckyplay.ph determines the purposes and means of processing your personal data.

luckyplay.ph has appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Privacy Policy and with the Data Privacy Act. The DPO can be contacted at the details provided in Section 14 of this Policy.

Where luckyplay.ph engages third-party service providers (such as game studios, payment processors, or identity verification services) to process personal data on its behalf, those parties act as Personal Information Processors (PIPs) and are bound by data processing agreements that require them to process data only in accordance with luckyplay.ph's instructions and in compliance with applicable Philippine data protection law.

3 Personal Data We Collect

luckyplay.ph collects the following categories of personal data, depending on how you interact with the platform:

luckyplay.ph does not intentionally collect sensitive personal information as defined under the Data Privacy Act (such as health data, religious beliefs, or political affiliations) unless specifically required by law or with your explicit consent.

4 How We Collect Your Data

luckyplay.ph collects personal data through the following means:

• Direct Interactions: Data you provide when you register an account, complete KYC verification, make a deposit or withdrawal, contact our support team, or update your account profile.
• Automated Technologies: Technical data collected automatically when you visit the luckyplay.ph website or use the platform, including through cookies, web beacons, server logs, and similar tracking technologies. See Section 7 for full details on our use of cookies.
• Third-Party Sources: Identity and fraud-screening data received from third-party KYC and identity verification providers engaged by luckyplay.ph to comply with AMLA and PAGCOR requirements. We may also receive data from payment processors in connection with deposit and withdrawal transactions.
• Publicly Available Sources: In limited circumstances, and only where permitted by law, luckyplay.ph may verify information against publicly available records, such as government databases or court records, for fraud prevention and regulatory compliance purposes.

5 Purpose & Legal Basis for Processing

luckyplay.ph processes your personal data only where there is a lawful basis for doing so under the Data Privacy Act of 2012. The following table sets out the purposes for which we process your data and the corresponding legal basis:

Where luckyplay.ph relies on consent as the legal basis for processing (for example, for marketing communications), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. To withdraw consent, contact our support team or update your communication preferences in your account settings.

6 Data Sharing & Disclosure

luckyplay.ph does not sell your personal data. We may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate data protection safeguards:

• Payment Processors: GCash, Maya, and partner banks (BPI, BDO, Metrobank, UnionBank, Landbank, PNB, Security Bank) receive the financial data necessary to process your deposit and withdrawal transactions.
• KYC & Identity Verification Providers: Third-party providers engaged to verify your identity and age in compliance with AMLA and PAGCOR requirements. These providers process your identity documents and biometric data under strict contractual data protection obligations.
• Game Content Providers: Licensed third-party game studios that supply games on the luckyplay.ph platform may receive limited technical and gaming data necessary for game delivery and fairness auditing.
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other competent Philippine government authorities, where disclosure is required by law, court order, or regulatory directive.
• IT & Security Service Providers: Cloud hosting, cybersecurity, and platform infrastructure providers who process data on our behalf under binding data processing agreements.
• Professional Advisers: Lawyers, auditors, and accountants who require access to certain data in the course of providing professional services to luckyplay.ph, subject to professional confidentiality obligations.

7 Cookies & Tracking Technologies

luckyplay.ph uses cookies and similar tracking technologies to operate the platform, enhance your experience, and gather analytics data. The following types of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the platform to function. They enable core features such as session management, login authentication, and security. These cookies cannot be disabled without affecting platform functionality.
• Functional Cookies: These cookies remember your preferences (such as language settings and display options) to provide a more personalized experience on luckyplay.ph.
• Analytics Cookies: These cookies collect aggregated, anonymized data about how players use the luckyplay.ph platform, helping us identify areas for improvement. No personally identifiable information is shared with analytics providers.
• Security Cookies: Used to detect and prevent fraudulent activity, bot traffic, and unauthorized access attempts on the luckyplay.ph platform.

Most web browsers allow you to control cookies through their settings. You may choose to block or delete cookies; however, please note that disabling strictly necessary cookies will impair your ability to use the luckyplay.ph platform. For instructions on managing cookies in your browser, refer to your browser's help documentation.

luckyplay.ph does not use cookies to serve third-party advertising or to track your browsing activity on other websites.

8 Data Retention

luckyplay.ph retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

• Account and Identity Data: Retained for the duration of your account and for a minimum of five (5) years following account closure, in compliance with AMLA record-keeping requirements.
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of the transaction, as required by AMLA and PAGCOR regulations.
• KYC Verification Documents: Retained for a minimum of five (5) years following the end of the business relationship, in accordance with AMLA requirements.
• Gaming History: Retained for a minimum of three (3) years for dispute resolution, responsible gaming monitoring, and regulatory audit purposes.
• Support Communications: Retained for two (2) years from the date of the last communication, for quality assurance and dispute resolution purposes.
• Technical and Log Data: Retained for up to twelve (12) months for security monitoring and fraud prevention purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with NPC-approved data disposal procedures. Where data is anonymized rather than deleted, the resulting anonymized data may be retained indefinitely for statistical and analytical purposes, as it no longer constitutes personal data under the Data Privacy Act.

9 Data Security

luckyplay.ph implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption: All data in transit is protected using 256-bit SSL/TLS encryption. Sensitive data at rest, including financial information and identity documents, is encrypted using industry-standard algorithms.
• Access Controls: Access to personal data is restricted to authorized luckyplay.ph personnel and service providers on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and regular data protection training.
• Two-Factor Authentication: luckyplay.ph supports and encourages the use of two-factor authentication (2FA) for player accounts to provide an additional layer of security against unauthorized access.
• Penetration Testing & Security Audits: The luckyplay.ph platform undergoes regular security assessments, including penetration testing and vulnerability scanning, conducted by qualified cybersecurity professionals.
• Incident Response: luckyplay.ph maintains a documented data breach response plan. In the event of a breach, our DPO will coordinate the response, notify the NPC, and communicate with affected players as required by law.

10 Your Data Rights

Under the Data Privacy Act of 2012, you have the following rights in relation to your personal data held by luckyplay.ph:

• Right to be Informed: You have the right to be informed about how your personal data is collected, used, and processed. This Privacy Policy fulfils that obligation.
• Right of Access: You have the right to request a copy of the personal data that luckyplay.ph holds about you, along with information about how it is being processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data held about you. You may update basic account information directly through your account settings.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations under AMLA and PAGCOR regulations.
• Right to Object: You have the right to object to the processing of your personal data where luckyplay.ph relies on legitimate interests as the legal basis, and where your interests override those of luckyplay.ph.
• Right to Data Portability: You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, where technically feasible.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the National Privacy Commission (NPC) if you believe that luckyplay.ph has processed your personal data in violation of the Data Privacy Act.

To exercise any of the above rights, please contact our Data Protection Officer using the details in Section 14. We will respond to all verified data rights requests within fifteen (15) business days of receipt, in accordance with NPC guidelines. We may need to verify your identity before processing your request.

11 Children's Privacy

The luckyplay.ph platform is strictly intended for individuals who are 21 years of age or older, in accordance with Philippine law and PAGCOR regulations governing online gambling. luckyplay.ph does not knowingly collect personal data from individuals under the age of 21.

Age verification is conducted as part of the mandatory KYC process for all new registrations. If luckyplay.ph discovers or has reason to believe that a registered account belongs to an individual under the age of 21, the account will be immediately suspended, all pending transactions will be cancelled, and any deposited funds will be returned to the originating payment method following verification.

If you are a parent or guardian and believe that your child has registered on the luckyplay.ph platform, please contact our Data Protection Officer immediately using the details in Section 14. We will investigate and take appropriate action promptly.

12 Cross-Border Data Transfers

In the course of operating the luckyplay.ph platform, your personal data may be transferred to and processed in countries outside the Philippines — for example, where our cloud infrastructure providers or game content partners maintain data centers or processing facilities.

Where such cross-border transfers occur, luckyplay.ph ensures that appropriate safeguards are in place to protect your personal data in accordance with the Data Privacy Act of 2012 and NPC regulations on cross-border data flows. These safeguards may include:

• Binding contractual clauses in data processing agreements with overseas processors that require them to maintain data protection standards equivalent to those required under Philippine law.
• Transfers to countries that have been assessed by the NPC as providing an adequate level of data protection.
• Other legally recognized transfer mechanisms as approved by the NPC from time to time.

You may request further information about the specific safeguards applicable to any cross-border transfer of your personal data by contacting our Data Protection Officer.

13 Updates to This Privacy Policy

luckyplay.ph reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or NPC guidance. When material changes are made, we will notify registered players by posting a prominent notice on the luckyplay.ph platform and, where practicable, by sending a notification to the email address associated with your account.

The date of the most recent revision is always displayed at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed of how luckyplay.ph protects your personal data. Your continued use of the platform following the effective date of any amendment constitutes your acknowledgment of the updated Policy.

14 Contact & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by luckyplay.ph, please contact our Data Protection Officer through the following channels:

• Data Protection Officer Email: [email protected]
• General Support Email: [email protected]
• Live Chat: Available 24 hours a day, 7 days a week, via the luckyplay.ph platform.
• Response Time: We aim to acknowledge all data privacy inquiries within two (2) business days and to provide a substantive response within fifteen (15) business days.

If you are not satisfied with our response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. The NPC is the independent government body responsible for administering and enforcing the Data Privacy Act of 2012.