Privacy Policy

1 About This Policy

This Privacy Policy applies to all personal data processed by luky91 in connection with the operation of its online casino and sports betting platform at luky91.org. It covers data collected from registered players, prospective players who visit the platform without registering, and individuals who contact luky91 through any official support channel.

luky91 acts as the data controller in respect of the personal data it collects directly from players. Where luky91 engages third-party service providers to process data on its behalf, those providers act as data processors and are bound by contractual obligations consistent with this policy.

This policy should be read alongside the luky91 Terms & Conditions and Responsible Gaming policy, both of which contain additional provisions relevant to the processing of your personal data.

2 Data We Collect

luky91 collects the following categories of personal data, depending on the nature of your interaction with the platform:

luky91 does not collect sensitive personal data categories such as racial or ethnic origin, political opinions, religious beliefs, or health data, except where expressly required for responsible gaming compliance purposes and with your explicit consent.

3 How We Collect Your Data

luky91 collects personal data through the following means:

• Direct collection: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal, contacting support, or participating in a promotion.
• Automated collection: Technical and usage data collected automatically when you access or interact with the luky91 platform, including through cookies, server logs, and session tracking technologies.
• Third-party sources: Identity verification data received from KYC and fraud prevention service providers, and transaction data received from payment processors such as JazzCash, EasyPaisa, HBL, and Meezan Bank.
• Publicly available sources: In limited circumstances, luky91 may supplement player data with information from publicly available sources for the purposes of fraud prevention or regulatory compliance.

4 Legal Basis for Processing

luky91 processes personal data only where a valid legal basis exists. The primary legal bases on which luky91 relies are as follows:

• Contractual necessity: Processing required to perform the contract between luky91 and the player — including account registration, processing deposits and withdrawals, and settling bets.
• Legal obligation: Processing required to comply with applicable laws and regulations, including anti-money laundering (AML) obligations, responsible gaming regulations, and tax reporting requirements.
• Legitimate interests: Processing carried out in pursuit of luky91's legitimate business interests — including fraud prevention, platform security, and improving user experience — where those interests are not overridden by your fundamental rights.
• Consent: Processing based on your explicit and freely given consent, particularly in relation to direct marketing communications. You may withdraw consent at any time.

5 How We Use Your Data

luky91 uses the personal data it collects for the following specific purposes:

• Creating and managing your luky91 account, including verifying your identity and age (21+) during the registration and KYC process
• Processing deposits and withdrawals in PKR via your selected payment method
• Detecting, investigating, and preventing fraudulent transactions, bonus abuse, and other prohibited conduct
• Complying with anti-money laundering (AML) and Know Your Customer (KYC) obligations under applicable regulations
• Operating responsible gaming tools, including monitoring betting patterns for signs of problem gambling and enforcing self-exclusion requests
• Personalising your platform experience, including surfacing relevant promotions and game recommendations
• Responding to customer support queries and resolving disputes
• Sending transactional communications such as deposit confirmations, withdrawal notifications, and security alerts
• Sending marketing communications where you have provided consent, including information about promotions, new games, and cricket betting markets
• Analysing platform usage data in aggregated, anonymised form to improve luky91's services

6 Data Sharing & Disclosure

luky91 does not sell or rent personal data to third parties. Data may be shared in the following limited circumstances:

• Payment processors: Financial data is shared with payment providers — including JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, and USDT network operators — strictly as necessary to process transactions on your behalf.
• KYC and fraud prevention providers: Identity data may be shared with regulated third-party KYC verification and fraud screening services to fulfil our legal obligations and protect the platform.
• Regulatory and law enforcement authorities: luky91 may disclose personal data to competent authorities where required by applicable law, court order, or official regulatory request.
• Group companies: Data may be shared within the luky91 group of companies for operational, compliance, and reporting purposes, subject to the same data protection standards as set out in this policy.
• Platform technology providers: Technical data may be accessed by trusted technology partners who provide hosting, security, analytics, and platform infrastructure services under strict confidentiality agreements.

All third-party recipients of personal data are required to process that data in accordance with applicable data protection law and are prohibited from using it for any purpose beyond the specific service they provide to luky91.

7 Cookies & Tracking Technologies

luky91 uses cookies and similar tracking technologies to operate the platform, personalise your experience, and analyse usage patterns. The following types of cookies are used:

• Strictly necessary cookies: Required for the platform to function correctly, including session management, login state, and security tokens. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings, preferred payment method, and display options to improve your experience.
• Analytics cookies: Collect aggregated, anonymised data about how players navigate the platform, which games are most popular, and where users encounter difficulty. This data is used solely to improve luky91's services.
• Marketing cookies: Used only where you have given consent, to track engagement with promotional communications and to avoid showing you irrelevant offers.

You may manage your cookie preferences through your browser settings at any time. Please note that disabling certain cookies may impair the functionality of the luky91 platform. Strictly necessary cookies cannot be disabled without preventing platform access entirely.

8 Data Retention

luky91 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for statistical analysis purposes.

9 Data Security

luky91 implements appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include, but are not limited to:

• 256-bit SSL/TLS encryption for all data transmitted between players and the platform
• Encryption of sensitive data fields (including financial information and CNIC data) at rest in luky91's databases
• Role-based access controls ensuring only authorised personnel can access personal data, on a strict need-to-know basis
• Regular security audits, vulnerability assessments, and penetration testing of platform infrastructure
• Two-factor authentication (2FA) options for player accounts to reduce the risk of unauthorised access
• Incident response procedures to detect, contain, and respond to any data security breach in a timely manner

Despite these measures, no digital platform can guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, luky91 will notify affected individuals and relevant authorities in accordance with applicable legal obligations.

10 International Data Transfers

The luky91 platform serves players primarily located in Pakistan. In certain operational contexts — such as the use of cloud hosting infrastructure or international KYC verification services — personal data may be processed or stored outside of Pakistan.

Where such transfers occur, luky91 ensures that adequate safeguards are in place to protect personal data to a standard at least equivalent to that required under applicable data protection law. These safeguards may include:

• Contractual clauses between luky91 and data recipients that impose legally binding data protection obligations
• Transfers to jurisdictions recognised as providing an adequate level of data protection
• Technical security controls that protect data in transit and at rest, regardless of the jurisdiction in which it is stored

If you have questions about the international transfer of your personal data, you may contact luky91 using the details in Section 15 of this policy.

11 Children & Minors

The luky91 platform is strictly intended for adults aged 21 years and above. luky91 does not knowingly collect personal data from individuals under the age of 21. If luky91 becomes aware that personal data has been collected from an individual under 21, that data will be deleted and the associated account closed immediately.

Age verification is performed as a mandatory step during the KYC process for all accounts. luky91 uses CNIC-based verification to confirm that all registered players meet the minimum age requirement. Parental controls are also strongly recommended for any shared devices on which the luky91 platform might be accessible.

12 Marketing Communications

luky91 may send you marketing communications about promotions, new games, cricket betting markets, and special offers where you have provided explicit consent to receive such communications at the time of registration or at any point thereafter.

Marketing communications may be delivered by the following channels, subject to your stated preferences:

• Email to your registered email address
• SMS to your registered mobile number
• In-platform notifications when you are logged in to your luky91 account

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Updating your communication preferences in your luky91 account settings
• Contacting our support team at [email protected] with an opt-out request

Withdrawal of marketing consent will not affect your ability to use the luky91 platform or receive transactional communications (such as deposit confirmations and security alerts), which are necessary for the operation of your account.

13 Exercising Your Data Rights

To exercise any of the data rights summarised at the top of this page — including access, rectification, erasure, portability, objection, or restriction — please submit a written request to our Data Protection team using the contact details provided in Section 15.

When submitting a data rights request, please include:

• Your full name and registered email address or mobile number
• The specific right you wish to exercise and a brief description of your request
• Any relevant account reference or transaction reference where applicable

luky91 will acknowledge your request within 5 business days and will respond substantively within 30 days. In complex cases, this period may be extended by a further 30 days, in which case you will be notified of the extension and the reason for it.

luky91 will not charge a fee for processing data rights requests unless the request is manifestly unfounded or excessive in scope. In such cases, luky91 reserves the right to charge a reasonable administrative fee or decline to process the request, having first notified you of its intention to do so.

14 Updates to This Policy

luky91 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform functionality. The effective date at the top of this page will be updated whenever a material change is made.

Where an update materially affects your rights or the way luky91 processes your personal data, we will provide advance notice via a platform notification or email to your registered address. For minor clarifications or non-material amendments, the updated policy will be published on this page without separate notification.

Your continued use of the luky91 platform following the publication of any revised Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the revised policy, you should cease using the platform and may request account closure.

15 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or luky91's handling of your personal data, please contact our Data Protection team through the following channel:

Email: [email protected]

Our support team is available 24 hours a day, 7 days a week. Data protection and privacy-related enquiries are escalated to our Data Protection Officer and will receive a substantive response within 5 business days.

This Privacy Policy was last reviewed and updated in January 2026. luky91 reserves all rights not expressly granted herein.