lucky91 Privacy Policy

This Privacy Policy ("Policy") describes how lucky91 ("lucky91", "we", "our", "us") collects, uses, stores, shares, and protects personal data relating to registered players, visitors, and prospective users of the lucky91 platform accessible at lucky91.im (the "Platform").

lucky91 is committed to operating transparently and in accordance with internationally recognised data protection principles. By accessing or using the lucky91 Platform, you acknowledge that you have read and understood this Policy and consent to the data practices described herein.

This Policy should be read alongside our Terms & Conditions and Responsible Gaming Policy, both of which are incorporated by reference. Where these documents conflict with this Policy on data matters, this Policy prevails.

We may update this Policy from time to time. The version currently published on this page is always the applicable version. Material changes will be communicated to registered players via their registered email address prior to taking effect.

For the purposes of this Policy, lucky91 acts as the data controller in respect of personal data collected through the Platform. As data controller, lucky91 determines the purposes for which, and the means by which, personal data is processed.

lucky91 operates under an international gaming license. All data processing activities are conducted in accordance with the data protection obligations imposed by our licensing jurisdiction and consistent with internationally recognised standards of data privacy.

If you have any questions, concerns, or requests relating to the processing of your personal data, you may contact lucky91's data team directly. Contact details are provided in Section 17 of this Policy.

lucky91 collects the following categories of personal data from users of the Platform:

lucky91 collects personal data through the following channels:

• Direct Registration: When you create a lucky91 account, you provide your name, email address, date of birth, phone number, and location directly through the registration form on the Platform.
• KYC Verification: When you complete identity verification (required before your first withdrawal and periodically thereafter), you upload identity documents such as a CNIC, passport copy, or utility bill. These documents are processed by lucky91's KYC system and, where applicable, by a licensed third-party identity verification provider.
• Payment Transactions: When you make a deposit or request a withdrawal via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or cryptocurrency, financial transaction data is recorded by lucky91's payment processing systems.
• Platform Usage: As you navigate the Platform, browse games, place bets, and interact with features, usage data is automatically collected through server logs, cookies, and similar technologies (see Section 11).
• Customer Support: When you contact our 24/7 live chat support team or send an email to [email protected], the content of those interactions is recorded and stored for quality assurance and dispute resolution purposes.
• Third-Party Sources: In limited circumstances, lucky91 may receive data about you from third-party sources, including identity verification bureaus, fraud prevention services, and payment processors, to supplement our own records and fulfil our compliance obligations.

lucky91 uses the personal data it collects for the following purposes:

• Account Management: To create, maintain, and administer your lucky91 player account, including processing your registration and verifying your identity.
• Age Verification: To ensure strict compliance with our 21+ age restriction policy. lucky91 is legally and ethically obligated to prevent minors from accessing gambling services.
• Payment Processing: To process deposits and withdrawals via your selected Pakistani payment method (JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, or crypto), and to maintain accurate financial records.
• Anti-Money Laundering (AML) and Fraud Prevention: To detect, investigate, and prevent fraudulent activity, money laundering, terrorist financing, and other financial crimes in accordance with our licensing obligations.
• Responsible Gaming: To monitor your gaming patterns and flag potential indicators of problem gambling, and to action self-exclusion requests, deposit limit changes, and cool-off periods you have set.
• Customer Support: To respond to your queries, resolve disputes, and provide 24/7 assistance via live chat and email.
• Marketing Communications: Where you have given explicit consent, to send you promotional emails, SMS notifications, or in-platform messages about bonuses, new games, PSL betting markets, and special offers tailored to Pakistani players.
• Platform Improvement: To analyse usage patterns, optimise the Platform's performance and user experience, and develop new features and products.
• Legal Compliance: To comply with applicable laws, licensing conditions, court orders, and regulatory directions, including data retention obligations.

lucky91 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contractual Necessity: Processing required to fulfil our obligations under the account agreement with you — including account creation, payment processing, and KYC verification — is conducted on the basis that it is necessary for the performance of a contract to which you are a party.
• Legal Obligation: Processing required to comply with our AML obligations, licensing conditions, regulatory requirements, and law enforcement directions is conducted on the basis of legal obligation.
• Legitimate Interests: Processing conducted for fraud prevention, platform security, responsible gaming monitoring, and product improvement is conducted on the basis of lucky91's legitimate business interests, provided those interests are not overridden by your rights and freedoms.
• Consent: Processing for direct marketing communications is conducted only where you have given us your explicit, freely given, and informed consent. You may withdraw your marketing consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

lucky91 does not sell, rent, or trade your personal data to any third party for their own commercial purposes. Data is shared with third parties only in the following limited and controlled circumstances:

• Payment Processors: We share financial transaction data with our payment processing partners — including JazzCash, EasyPaisa, and our banking partners — strictly to the extent necessary to process your deposits and withdrawals.
• KYC and Identity Verification Providers: Where required for identity verification, we may share your identity documents with licensed third-party KYC and age verification service providers. These providers are contractually bound to handle your data securely and use it only for verification purposes.
• Game Providers: When you play casino games, limited technical data (such as a session token or player ID) may be shared with the game provider to facilitate gameplay. Game providers do not receive your full personal identity information.
• Fraud Prevention Services: We share relevant data with fraud detection and AML compliance services to screen transactions and prevent financial crime, as required under our licensing obligations.
• Legal and Regulatory Authorities: We will disclose personal data to law enforcement, regulatory authorities, or courts when required to do so by a valid legal order, warrant, or regulatory directive. We will, where permitted by law, attempt to notify affected users of such disclosures.
• Professional Advisers: Our lawyers, accountants, and auditors may access personal data to the extent necessary to provide their professional services, subject to strict professional confidentiality obligations.

All third parties with whom lucky91 shares personal data are required to maintain appropriate technical and organisational security measures and are permitted to use the data only for the specific purposes for which it is shared.

As an internationally licensed online gaming platform serving Pakistani players, lucky91 may transfer personal data to, and process personal data in, countries outside Pakistan. This may include countries where our servers are hosted, where game providers are based, or where our KYC and payment processing partners operate.

Where personal data is transferred internationally, lucky91 takes the following safeguards to ensure your data remains protected:

• Transfers to countries recognised as providing an adequate level of data protection are made without additional safeguards.
• Transfers to other countries are made subject to appropriate contractual protections — such as standard contractual clauses or equivalent binding data transfer agreements — that obligate the receiving party to protect your data to standards equivalent to those applied by lucky91.
• Where transfers are made to group entities or affiliated entities, we rely on binding intra-group data transfer agreements.

By using the lucky91 Platform, you acknowledge and consent to your personal data being processed in the international locations described above, subject always to the safeguards stated in this Policy.

lucky91 retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. The following retention guidelines apply:

• Active Account Data: All personal data associated with your active lucky91 account is retained for the duration of the account relationship and for a period of five (5) years following account closure, unless a longer period is required by law or licensing obligation.
• Financial Transaction Records: Records of all deposits, withdrawals, and bonus transactions are retained for a minimum of five (5) years following the transaction date, in compliance with AML regulatory requirements applicable under our international gaming license.
• KYC and Identity Documents: Identity verification documents are retained for a minimum of five (5) years following account closure, or longer if required by applicable law.
• Support Communications: Live chat transcripts and email support records are retained for two (2) years from the date of the interaction, except where they relate to a dispute or investigation, in which case they are retained until final resolution plus the applicable limitation period.
• Marketing Data: Marketing consent records and associated data are retained for the duration of your consent and for one (1) year following withdrawal of consent, to demonstrate compliance.
• Technical and Usage Data: Server logs, session data, and anonymised usage analytics are retained for up to twelve (12) months before being deleted or permanently anonymised.

When personal data is no longer required, it is securely deleted or permanently anonymised using industry-standard data destruction processes.

lucky91 employs a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:

• TLS Encryption in Transit: All data transmitted between your device and the lucky91 Platform is encrypted using Transport Layer Security (TLS 1.2 or higher), the same technology used by major financial institutions.
• Encryption at Rest: Sensitive personal data stored in lucky91's databases — including identity documents and financial information — is encrypted at rest using AES-256 or equivalent industry-standard encryption.
• Access Controls: Access to personal data within lucky91's systems is strictly limited to authorised personnel who require access to perform their job functions. All internal access is logged and subject to regular access review.
• Two-Factor Authentication: Player accounts support two-factor authentication (2FA) to prevent unauthorised access. Internal system access by lucky91 staff is mandatorily protected by 2FA.
• Regular Security Audits: lucky91's systems and infrastructure are subject to regular security assessments, penetration testing, and vulnerability scanning by internal and external security specialists.
• Incident Response: lucky91 maintains a documented data breach response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant regulatory authority within the timeframes required under applicable law.

While lucky91 takes all reasonable precautions to protect your data, no internet transmission or electronic storage system is 100% secure. You are also responsible for maintaining the security of your own device and login credentials. See Section 4 of the Terms & Conditions for account security obligations.

lucky91 uses cookies and similar tracking technologies on the Platform to provide core functionality, improve your experience, and support our security and analytics operations. The following categories of cookies are used:

• Strictly Necessary Cookies: These cookies are essential for the Platform to function correctly. They enable login session management, security token validation, and navigation. These cookies cannot be disabled without impairing core Platform functionality.
• Functional Cookies: These cookies remember your preferences (such as language settings, preferred payment method display, or responsible gaming settings you have configured) to provide a personalised experience.
• Analytics Cookies: lucky91 uses first-party analytics tools to collect anonymised usage data about how players navigate the Platform, which games are most played, and where technical issues occur. This data is used exclusively to improve the Platform and is not shared with third-party advertising networks.
• Security Cookies: These cookies support lucky91's fraud detection and account protection systems by identifying unusual session behaviour or concurrent login attempts from multiple locations.

lucky91 does not use third-party advertising or retargeting cookies. You will not see lucky91 advertisements following you across unrelated websites based on your Platform activity.

You may manage your cookie preferences through your browser settings. Disabling strictly necessary cookies will impair your ability to use the Platform. Disabling functional or analytics cookies will not prevent access but may reduce the quality of your experience.

Subject to applicable law and our licensing obligations, you have the following rights in relation to the personal data lucky91 holds about you:

• Right of Access: You may request a copy of the personal data lucky91 holds about you. We will provide this information within thirty (30) days of your verified request, free of charge for the first request in any twelve-month period.
• Right to Rectification: You may request the correction of inaccurate or incomplete personal data. Where it is technically possible to amend data directly within your account settings, you are encouraged to do so. For KYC documents and verified data, correction must be processed via our support team.
• Right to Erasure: You may request the deletion of your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw your consent and no other legal basis applies. This right is subject to exceptions where retention is required by law (e.g., AML and financial records).
• Right to Restriction: You may request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to processing based on legitimate interests.
• Right to Data Portability: Where processing is based on your consent or on a contractual basis, you may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where it is based on lucky91's legitimate interests. You also have an absolute right to object to the use of your personal data for direct marketing purposes at any time, without needing to provide a reason.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time by contacting support or adjusting your communication preferences within your account settings. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact our data team via the 24/7 live chat on the Platform or by emailing [email protected]. We may require identity verification before processing your request to protect against unauthorised access to your data.

lucky91 employs the following measures to prevent minors from accessing the Platform:

• Date of birth is collected at the point of registration and validated against the declared age threshold of 21+.
• Identity verification (KYC) requires submission of a government-issued identity document confirming date of birth before withdrawal privileges are granted.
• Where our systems detect indicators of a potentially underage user, the account will be suspended pending identity verification.

If you are a parent or guardian and believe that a minor in your care has created a lucky91 account, please contact us immediately at [email protected] so we can investigate and take appropriate action.

lucky91 uses your usage data and gaming pattern data for responsible gaming purposes. This is a core part of our licensing obligations and our genuine commitment to player welfare. Specifically:

• lucky91's systems automatically monitor gaming behaviour for indicators of problem gambling, such as rapidly escalating bet sizes, extended unbroken playing sessions, and repeated failed withdrawal attempts following losses.
• Where such indicators are detected, an automated alert may be triggered and a member of our responsible gaming team may contact you through your registered contact details to offer support.
• Data you provide when setting responsible gaming controls — such as deposit limits, loss limits, session time alerts, and self-exclusion requests — is processed to implement and enforce those controls in real time.
• Self-exclusion data is retained for a minimum of six (6) years, even if you subsequently request account deletion, to prevent re-registration during an active exclusion period.

For more information about lucky91's responsible gaming tools and resources, please visit our dedicated Responsible Gaming page. Play within your means. Gambling involves risk.

The lucky91 Platform may contain links to third-party websites in certain contexts — such as links to payment provider information pages or game provider certification pages. This Privacy Policy applies only to the lucky91 Platform at lucky91.im and does not govern the privacy practices of any third-party website.

lucky91 is not responsible for the privacy practices, security standards, or content of any third-party websites. We encourage you to review the privacy policy of any third-party site you visit independently of the lucky91 Platform.

lucky91 reserves the right to update, revise, or replace this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform functionality. The date of the most recent revision is always displayed at the top of this page.

Where we make material changes to this Policy — particularly changes that affect the way we use your data or the rights available to you — we will notify all registered players via their registered email address at least fourteen (14) days before the changes take effect.

Your continued use of the lucky91 Platform following the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, please cease using the Platform and contact support to arrange account closure.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact lucky91's data team through the following channels:

• 24/7 Live Chat: Available directly within the lucky91 Platform after login — the fastest way to reach our team for data rights requests.
• Email: [email protected] — for formal data rights requests, please include "Data Privacy Request" in the subject line.

lucky91 is committed to resolving all privacy-related concerns promptly and fairly. If you are dissatisfied with our response to a data rights request or privacy complaint, you have the right to lodge a complaint with the relevant data protection supervisory authority in the jurisdiction applicable under our international gaming license.

lucky91 is operated under an international gaming license. All games are tested for fairness. Gambling involves risk — only wager what you can afford to lose. 21+ only.