Privacy Policy — luckyplay.ph

Who We Are — Data Controller

For the purposes of the Data Privacy Act of 2012 (Republic Act 10173) and its Implementing Rules and Regulations, luckyplay.ph — operated through the website at luckyplayph.vip — acts as the Personal Information Controller (PIC) in respect of all personal data collected from persons who visit, register on, or transact through the Platform.

luckyplay.ph determines the purpose and means of processing your personal information in connection with the operation of the online casino, sports betting, and gaming services described in our Terms and Conditions. All data processing activities conducted by luckyplay.ph are registered with and subject to the regulatory oversight of the National Privacy Commission (NPC) of the Philippines.

Our designated Data Protection Officer (DPO) can be contacted at [email protected] with the subject line "DATA PRIVACY — DPO REQUEST" for any matter relating to your personal data or this Privacy Policy.

Personal Data We Collect

luckyplay.ph collects personal data necessary to operate the Platform, comply with Philippine legal and regulatory obligations, and deliver a secure and personalized gaming experience to Members. The categories of personal data we process include:

luckyplay.ph does not collect sensitive personal information — as defined under Section 3(l) of the Data Privacy Act — except where expressly required by PAGCOR licensing conditions or anti-money laundering regulations.

How We Collect Your Personal Data

luckyplay.ph collects personal data through the following channels:

Purposes of Processing Personal Data

luckyplay.ph processes your personal data for the following specific, legitimate purposes:

• Account Registration and Management — creating and maintaining your Member account, authenticating your identity at login, and managing account settings;
• Identity and Age Verification — confirming that you meet the minimum age requirement of 21 years and verifying your identity as required by PAGCOR regulations;
• Payment Processing — processing deposits and withdrawals through GCash, PayMaya, and Philippine bank channels, and reconciling transaction records;
• Regulatory Compliance — meeting obligations under the Anti-Money Laundering Act (RA 9160), PAGCOR licensing requirements, NPC registration requirements, and other applicable Philippine laws;
• Fraud Prevention and Security — detecting, investigating, and preventing fraudulent activity, account compromise, and prohibited conduct;
• Responsible Gaming — monitoring gaming patterns to identify indicators of problem gambling and applying Member-requested or platform-initiated responsible gaming tools;
• Customer Support — responding to inquiries, resolving disputes, and providing account assistance;
• Platform Improvement — analyzing aggregated and anonymized usage data to improve the Platform's performance, design, and feature set;
• Communications — sending transactional notifications (deposit confirmations, withdrawal updates, security alerts) and, where you have consented, promotional communications about Platform offers.

luckyplay.ph does not process your personal data for purposes incompatible with those listed above without your prior consent.

Legal Basis for Processing

Processing of your personal data by luckyplay.ph is grounded in one or more of the following lawful bases recognized under Section 12 and Section 13 of the Data Privacy Act of 2012:

• Contractual Necessity — processing is necessary for the performance of the contract between you and luckyplay.ph (i.e., providing the gaming and betting services you registered to use);
• Legal Obligation — processing is required for compliance with a legal obligation to which luckyplay.ph is subject, including PAGCOR licensing conditions, AML reporting duties, and NPC registration requirements;
• Legitimate Interests — processing is necessary for the legitimate interests of luckyplay.ph (such as fraud prevention and platform security), provided such interests are not overridden by your fundamental rights and freedoms;
• Consent — where processing is not otherwise covered by the above bases, luckyplay.ph will seek your explicit consent before processing. Where consent is the basis for processing, you have the right to withdraw it at any time without affecting the lawfulness of processing conducted prior to withdrawal.

Sharing of Personal Data

luckyplay.ph does not sell, rent, or trade your personal data to third parties for marketing or commercial purposes. Personal data may be disclosed to the following categories of recipients strictly on a need-to-know basis:

Cookies & Tracking Technologies

luckyplay.ph uses cookies and similar tracking technologies when you access the Platform through a web browser. Cookies are small data files stored on your device that help us operate the Platform efficiently and securely.

Most web browsers allow you to manage or disable non-essential cookies through browser settings. Disabling strictly necessary or security cookies may prevent you from accessing the Platform or certain features. luckyplay.ph does not use third-party advertising cookies or behavioral tracking cookies for cross-site marketing purposes.

Data Security Measures

luckyplay.ph implements technical and organizational measures appropriate to the sensitivity of the personal data processed and the risks associated with operating an online gaming platform. These measures include:

• Encryption in Transit — all data transmitted between your device and the Platform is encrypted using TLS 1.2 or higher (256-bit SSL). The padlock icon displayed in your browser's address bar confirms an encrypted connection is active;
• Encryption at Rest — sensitive data including identity documents and payment references stored on Platform servers is encrypted using industry-standard algorithms;
• Password Security — Member passwords are stored exclusively as salted cryptographic hashes — never in plain text. luckyplay.ph staff and contractors have no ability to view your password;
• Access Controls — internal access to personal data is restricted on a least-privilege basis. Staff who do not require access to specific data categories as part of their role do not have access;
• Two-Factor Authentication — available to all Members and recommended for all accounts holding a PHP balance;
• Intrusion Detection — automated monitoring systems flag anomalous access patterns and potential security incidents for immediate review;
• Regular Security Audits — the Platform undergoes periodic security assessments and vulnerability testing by qualified cybersecurity professionals.

Data Retention

luckyplay.ph retains personal data only for as long as necessary to fulfill the purposes for which it was collected, including compliance with legal, regulatory, tax, accounting, and reporting obligations.

The following retention periods apply:

• Active Account Data — retained for the duration of your active membership plus five (5) years following account closure, as required by PAGCOR licensing conditions and AML record-keeping obligations under Republic Act 9160;
• Transaction Records — retained for a minimum of five (5) years from the date of each transaction in accordance with AML regulations;
• KYC and Identity Documents — retained for the duration of your membership and for five (5) years after account closure or last transaction, whichever is later;
• Support Communications — retained for three (3) years from the date of the communication to support dispute resolution;
• Technical and Log Data — retained for twelve (12) months for security monitoring purposes, after which it is anonymized or deleted;
• Marketing Consent Records — retained for the duration of your consent and for two (2) years following withdrawal of consent as evidence of lawful processing.

At the end of applicable retention periods, personal data is securely deleted or anonymized in a manner that renders re-identification impossible.

Your Data Subject Rights

Under the Data Privacy Act of 2012 and its Implementing Rules and Regulations, registered Members of luckyplay.ph have the following rights with respect to their personal data:

To exercise any of the above rights, submit a written request to [email protected] with the subject line "DATA PRIVACY REQUEST — [Right Type]". You will be required to verify your identity before any request is actioned. Requests will be acknowledged within 5 business days and resolved within 15 business days unless the complexity of the request requires an extension, in which case you will be informed accordingly.

If you believe luckyplay.ph has not handled your personal data in accordance with the Data Privacy Act, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines through their official channels.

Children's Privacy

Cross-Border Data Transfers

luckyplay.ph primarily processes and stores personal data on servers located in jurisdictions that provide an adequate level of data protection. Where personal data is transferred to third-party service providers located outside the Philippines — for example, certain cloud infrastructure or game platform providers — luckyplay.ph ensures that such transfers are subject to appropriate safeguards, including:

• Contractual clauses that require the recipient to process the data in accordance with standards consistent with the Data Privacy Act;
• Transfers only to jurisdictions or recipients that can demonstrate adequate data protection standards;
• Prior assessment of the data protection practices of all international third-party processors before engagement.

The minimum standard applied to any cross-border transfer is that the processing must be lawful, fair, and transparent, and the data must be protected against unauthorized access, disclosure, or misuse to a degree at least equivalent to the protections provided under Philippine law.

Amendments to This Privacy Policy

luckyplay.ph reserves the right to update or revise this Privacy Policy at any time. The most current version is published at luckyplayph.vip/privacy-policy with the effective date indicated at the top.

Material changes to this Privacy Policy — particularly those that significantly alter how your personal data is collected, used, or shared — will be communicated to registered Members via the email address associated with their account at least seven (7) days prior to the effective date of the change, except where immediate revision is required by Philippine law or an NPC directive.

Your continued use of the Platform after the effective date of any amendment constitutes your acknowledgment of and, where applicable, consent to the updated Privacy Policy. If you do not agree to the revised Policy, you may request account closure in accordance with the Terms and Conditions.

Contact & Data Protection Officer

luckyplay.ph has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Privacy Policy. The DPO is the primary point of contact for all data privacy matters.

You also have the right to lodge a complaint directly with the National Privacy Commission of the Philippines if you believe your data rights have been infringed. The NPC provides an online complaint portal and dedicated helpline for data privacy concerns.