Privacy Policy — How Lucky100 Protects Your Data

Lucky100 operates the online betting and casino platform accessible at lucky100.bio. For the purposes of this Privacy Policy, Lucky100 is the data controller responsible for the personal information of all registered members and site visitors in Pakistan.

This policy applies to all Lucky100 services, including cricket betting, live casino, roulette, virtual sports, the Lucky100 VIP Club, and any related mobile-optimised experience you access via the same domain. It covers data collected through any device — smartphone, tablet or desktop — and through any connection, including mobile data and WiFi.

Lucky100 collects only the personal information that is necessary to operate your account and deliver the services you've signed up for. Here is a breakdown of the categories of data we collect and how they're gathered:

Lucky100 does not collect sensitive personal data such as biometric data, religious beliefs or political opinions. The verification data collected (CNIC scans etc.) is used solely for age and identity verification and AML compliance and is handled with the highest level of security.

Lucky100 processes your personal data only for specific, legitimate purposes. Every piece of data we collect has a defined reason. Here are the purposes that apply to Lucky100 members in Pakistan:

• Account management: To create and maintain your Lucky100 account, authenticate your logins, manage your VIP tier and process your requests.
• Transaction processing: To process your PKR deposits and withdrawals via Easypaisa, JazzCash, NayaPay, SadaPay, IBFT and card, and to maintain accurate financial records.
• Identity and age verification: To confirm that you are aged 18 or above and that you are who you say you are. This is a legal requirement for online gaming platforms and Lucky100 takes it seriously.
• Anti-money laundering (AML) compliance: To detect and prevent financial crime. Lucky100 is required by its licensing conditions to monitor transaction patterns and report suspicious activity.
• Customer support: To respond to your questions, resolve disputes, process bonus claims and manage responsible gaming requests.
• Responsible gaming: To enforce deposit limits, cooling-off periods and self-exclusion arrangements that you have requested, and to identify patterns that may indicate problem gambling so that appropriate support can be offered.
• Platform improvement: To analyse how Lucky100 is used — which sections are popular, where users encounter difficulty, how performance can be improved — in order to make the platform better for all Pakistani members.
• Marketing (with consent): To send you promotional offers, bonus notifications and Lucky100 news via SMS or email, but only if you have opted in or have not opted out. You can withdraw marketing consent at any time.
• Legal obligations: To comply with any applicable legal or regulatory requirements, including the retention of records as mandated by financial regulations.

Lucky100 handles PKR payment data with the highest level of protection because we understand what's at stake when someone trusts a platform with their financial information. Here is exactly how payment data is managed on Lucky100:

• Card numbers are never stored on Lucky100 servers in plain text. Card data is tokenised at point of entry and processed through PCI-DSS compliant payment processors.
• Easypaisa and JazzCash wallet IDs are stored in encrypted form and are only used to process transactions you have authorised.
• IBFT bank account details provided for withdrawal purposes are encrypted at rest and accessed only by the Lucky100 payments team for the specific purpose of processing your withdrawal.
• Transaction records — amounts, dates, transaction IDs — are retained for a minimum of five years as required by anti-money laundering regulations. These records are not used for any marketing purpose.
• Third-party payment processors used by Lucky100 operate under strict data processing agreements. They may process your payment data only for the purpose of completing your transaction — nothing beyond that.

Lucky100 does not sell or rent your personal data to anyone. We share data only where it is necessary to operate the platform, comply with the law or protect the security of the platform and its members. Below are the categories of third parties with whom data may be shared:

• Payment processors: To process your PKR deposits and withdrawals. These providers operate under contract and are permitted to use your data only for the stated payment purpose.
• Identity verification services: Third-party KYC (Know Your Customer) providers that verify your CNIC, passport or other documents. They process data on Lucky100's behalf under strict confidentiality agreements.
• Live casino game providers: Live dealer game software providers may receive limited technical session data needed to deliver the game to your device. They do not receive your financial or identity data.
• Analytics providers: Aggregated and anonymised usage data may be shared with analytics platforms to help improve Lucky100. No personally identifiable information is shared with analytics providers.
• Legal authorities: Lucky100 may be required to disclose personal data to regulatory bodies, law enforcement agencies or courts in Pakistan in response to a lawful request. Lucky100 will always verify the legality of any such request before complying.

In all cases of data sharing, Lucky100 requires that the receiving party maintains adequate data protection standards and uses your data only for the stated purpose. No data is shared with parties outside this list without explicit member consent.

Lucky100 uses cookies — small text files placed on your device — to make the platform work correctly and to understand how it is used. Below is a breakdown of the cookie types in use:

Essential cookies cannot be disabled as they are required for Lucky100 to function. Functional and analytics cookies can be disabled from your browser settings or the Lucky100 cookie preferences panel. Disabling analytics cookies will not affect your ability to bet, play or make PKR transactions on Lucky100.

Lucky100 takes data security seriously — not because it sounds good in a privacy policy, but because the consequences of a security failure for Pakistani members are real and significant. Here is what is actually in place to protect your data:

• TLS encryption in transit: All data transmitted between your device and Lucky100 servers is encrypted using TLS (Transport Layer Security). You'll see the padlock in your browser address bar whenever you're on lucky100.bio.
• Encryption at rest: Sensitive data fields — payment details, identity documents, passwords — are encrypted in the database. Even in the event of a data breach, encrypted fields would not be readable without the decryption keys, which are stored separately.
• Access controls: Lucky100 staff access to personal data is restricted on a need-to-know basis. Customer support agents can see the account information necessary to help you — they cannot access your payment credentials or full identity documents.
• Two-factor authentication (2FA): All Lucky100 members can enable 2FA on their accounts. Lucky100 staff with access to member data use mandatory 2FA on all systems.
• Regular security audits: Lucky100 conducts regular independent security audits of the platform and its data infrastructure. Vulnerabilities identified are addressed on a priority basis.
• Incident response: In the event of a data security incident that affects your personal data, Lucky100 will notify affected members as quickly as possible — within 72 hours of becoming aware of the incident where feasible — and will provide clear information about what happened and what steps are being taken.

Lucky100 does not hold onto data longer than necessary. Retention periods are set by two factors: the legitimate business need to keep the data and regulatory requirements that mandate certain retention periods.

• Active account data: Retained for as long as your Lucky100 account remains active — that is, for as long as you want to keep playing.
• Transaction records: PKR transaction history, including deposits and withdrawals, is retained for a minimum of five years after the last transaction date, as required under anti-money laundering regulations.
• Identity verification documents: Retained for five years from the date of verification or the date your account is closed, whichever is later. This is a regulatory requirement.
• Support communications: Live chat transcripts and email support records are retained for two years after the last interaction.
• Closed account data: When a Lucky100 account is closed, personal data is anonymised or deleted within 90 days, except for the categories above that are subject to extended regulatory retention periods.

As a Lucky100 member, you have the following rights over your personal data. To exercise any of these rights, contact Lucky100 support via live chat or at support@lucky100.bio.

Lucky100 is strictly an adults-only platform. No person under the age of 18 is permitted to register an account or use any Lucky100 service. Lucky100 does not knowingly collect personal data from individuals under 18.

If Lucky100 discovers or is informed that an account has been created by a person under 18, the account will be closed immediately, all balances will be forfeited and all personal data associated with the account will be deleted as soon as the regulatory minimum retention period allows.

If you believe that a person under 18 has created a Lucky100 account, please contact support immediately at support@lucky100.bio. We treat these reports with urgency.

Lucky100 may update this Privacy Policy from time to time to reflect changes in our practices, in the services we offer, or in legal and regulatory requirements. The most current version will always be published at lucky100.bio/privacy-policy with the updated date clearly displayed at the top of the page.

When material changes are made to this policy — changes that significantly affect how your data is processed or your rights as a member — Lucky100 will notify all registered members via email to their registered address and via an in-platform notification. For minor updates (clarifications, formatting), no separate notification will be issued but the policy date will reflect the change.

Continued use of Lucky100 after a policy update constitutes acceptance of the revised terms. If you disagree with any changes, you are entitled to close your account and request deletion of your data in accordance with Section 9 above.

If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how Lucky100 is handling your personal information, there are several ways to get in touch:

• Live chat: Available 24/7 directly on the Lucky100 platform. This is the fastest route for urgent queries.
• Email: support@lucky100.bio — for written requests, data subject access requests and formal complaints. Response within 5 business days.
• VIP account manager: If you are a Gold, Platinum or Diamond tier Lucky100 VIP member, your personal account manager can handle privacy requests directly.

Lucky100 takes privacy complaints seriously. If you raise a concern with us and are not satisfied with the response, you have the right to refer the matter to the relevant data protection authority in your jurisdiction.