lucky.ph Privacy Policy

1Who We Are

Lucky.ph ("lucky.ph," "we," "us," or "the Company") operates the online casino platform accessible at luckyph.one, serving players located in the Philippines under PAGCOR authorization. For the purposes of the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations (IRR), lucky.ph acts as the Personal Information Controller in respect of the personal data processed through the Platform.

Lucky.ph is subject to the jurisdiction of the National Privacy Commission (NPC) of the Philippines. Our Data Protection Officer (DPO) can be contacted using the details provided in Section 14 of this Policy.

2Scope of This Policy

This Privacy Policy applies to:

• All registered users ("Players") of the lucky.ph Platform at luckyph.one;
• Persons who visit the lucky.ph website without registering;
• Persons who contact lucky.ph customer support by any channel;
• Persons who participate in lucky.ph promotions or surveys.

This Policy does not apply to third-party websites or services linked from the Platform, nor to the data practices of game providers, payment processors, or other partners whose own privacy policies govern their handling of your data when you interact directly with their services.

3Information We Collect

Lucky.ph collects personal information from you directly, automatically, and in some cases from third parties. The categories of information we collect are as follows:

3.1 Registration & Account Data

When you create an Account on lucky.ph, we collect:

• Full legal name;
• Date of birth (to verify the 21+ age requirement);
• Philippine mobile number;
• Email address;
• Username and encrypted password.

3.2 Identity Verification (KYC) Data

Before processing your first withdrawal, and at any time where PAGCOR regulations or anti-money laundering obligations require it, we collect:

• Copies of valid Philippine government-issued photo identification (e.g., UMID, PhilSys National ID, Driver's License, Passport);
• Selfie photographs taken alongside your ID document;
• Proof of address documents where required;
• Proof of payment method ownership where required.

KYC documents are classified as sensitive personal information under the Data Privacy Act and are subject to a higher standard of protection.

3.3 Financial & Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and reference numbers;
• Payment method details (GCash account number, bank account details, cryptocurrency wallet addresses) — stored only to the extent necessary for transaction processing and AML compliance;
• Wallet balance history.

3.4 Gaming Activity Data

• Game session logs, including games played, wagers placed, outcomes, and session durations;
• Bonus and promotion participation records;
• Responsible gaming tool settings (deposit limits, self-exclusion status).

3.5 Technical & Usage Data

When you access the Platform, our servers automatically collect:

• IP address and approximate geographic location derived therefrom;
• Device type, operating system, and browser information;
• Pages visited, features used, and navigation paths within the Platform;
• Session start and end timestamps;
• Cookie identifiers (see Section 9).

3.6 Support Communication Data

• The content of live chat conversations, emails, and any other communications you send to lucky.ph support;
• Records of complaints and their resolution outcomes.

3.7 Data We Do Not Collect

Lucky.ph does not collect or store full payment card (credit/debit card) numbers. Lucky.ph does not knowingly collect personal data from persons under the age of 21. Lucky.ph does not collect data about your race, religion, political opinions, or health status unless you voluntarily provide such information in a support communication.

4How We Use Your Information

We use the personal data we collect for the following purposes:

5Legal Basis for Processing

Under the Data Privacy Act of 2012 and its IRR, lucky.ph processes your personal data on the following legal grounds:

• Contractual necessity: Processing required to create and manage your Account, process payments, settle game outcomes, and provide the services you have contracted for when you registered on the Platform;
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, the Anti-Money Laundering Act (RA 9160, as amended), the Cybercrime Prevention Act (RA 10175), NPC regulations, and any other applicable Philippine law;
• Legitimate interest: Processing for fraud prevention, Platform security, responsible gaming monitoring, and aggregated analytics, where those interests are not overridden by your privacy rights;
• Consent: Processing for optional purposes such as marketing communications, where we have obtained your explicit prior consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6Sharing Your Personal Data

Lucky.ph does not sell your personal data to any third party. We share personal data only in the following limited circumstances:

6.1 Service Providers & Processors

We engage third-party service providers who process personal data on our behalf and under our instruction, subject to appropriate data processing agreements. These include:

• Game providers (such as JILI Games, Pragmatic Play, PG Soft, and Evolution Gaming) — who receive sufficient player session data to operate and settle game outcomes;
• Payment processors (GCash, Maya, BPI, BDO, UnionBank, Coins.ph, 7-Eleven Cliqq, USDT TRC20 gateway providers) — who receive the financial data necessary to process your transactions;
• KYC / identity verification platforms — who assist in processing identity documents submitted during the verification process;
• Cloud hosting and infrastructure providers — who host Platform data in secure server environments;
• Customer support platforms — who provide the software infrastructure for our live chat and ticketing systems.

6.2 Regulatory Authorities

Lucky.ph is required to disclose player data to PAGCOR and other competent Philippine regulatory authorities (including the Anti-Money Laundering Council and law enforcement agencies) in accordance with our licensing obligations, upon lawful request, or as required by Philippine law. We will comply with such requests to the minimum extent required by law.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of the lucky.ph business, player data may be transferred as part of that transaction. We will provide notice to affected players before their data becomes subject to a different privacy policy.

6.4 With Your Consent

We may share your data with other parties where you have given us your explicit consent to do so.

7Data Retention

Lucky.ph retains your personal data for as long as necessary to fulfill the purposes for which it was collected, subject to the following minimum retention periods required by Philippine law:

• Account and registration data: Retained for the duration of your Account, plus a minimum of five (5) years following Account closure — as required by PAGCOR licensing conditions;
• KYC documents: Retained for a minimum of five (5) years following Account closure, consistent with AMLC record-keeping requirements under RA 9160;
• Financial and transaction records: Retained for a minimum of five (5) years — consistent with AML obligations and Philippine accounting law;
• Gaming activity logs: Retained for a minimum of two (2) years or as required by PAGCOR;
• Support communications: Retained for two (2) years from the date of the communication;
• Technical and usage data: Retained for thirteen (13) months in identifiable form; thereafter anonymized or deleted.

Where data is retained beyond the active service relationship purely to comply with legal obligations, it is stored securely and access is restricted to personnel with a specific need to access it for compliance purposes.

8How We Protect Your Data

Lucky.ph implements technical and organizational measures designed to protect your personal data against unauthorized access, loss, destruction, or alteration. These measures include:

• Encryption in transit: All data transmitted between your browser or device and the lucky.ph Platform is encrypted using TLS (Transport Layer Security), the same standard used by Philippine banks and financial institutions;
• Encryption at rest: Sensitive data stored on lucky.ph servers, including KYC documents and financial records, is encrypted at rest using AES-256 or equivalent standards;
• Password security: Account passwords are stored as cryptographic hashes — never in plaintext. Lucky.ph staff cannot retrieve your password; only a reset can be issued;
• Access controls: Access to production systems and personal data is restricted on a need-to-know basis. Staff undergo periodic security training. Privileged access is logged and audited;
• Two-factor authentication: SMS OTP-based two-factor authentication is available to all Players and is enforced for privileged administrative access;
• Fraud detection: Automated systems monitor login patterns, transaction anomalies, and device fingerprints to detect and respond to suspicious activity in real time;
• Vulnerability management: Lucky.ph undergoes periodic security assessments and acts promptly on identified vulnerabilities.

9Cookies & Tracking Technologies

Lucky.ph uses cookies and similar tracking technologies on the Platform for the purposes described below. A cookie is a small text file stored on your device by your browser when you visit a website.

9.1 Categories of Cookies We Use

• Strictly necessary cookies: Required for the Platform to function. These include session authentication tokens, CSRF protection tokens, and load-balancing cookies. You cannot opt out of these without disabling your ability to use the Platform;
• Functional cookies: Remember your preferences such as language settings and last-accessed game category;
• Analytics cookies: Collect aggregated and anonymized information about how Players use the Platform — which pages are visited most, where users drop off, and similar patterns — to help us improve the Platform;
• Security cookies: Used by our fraud detection systems to identify and manage suspicious login activity and session anomalies.

9.2 Managing Cookies

You can control and delete cookies through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. Disabling analytics cookies will not affect your ability to play. For instructions on managing cookies in Chrome, Safari, or other browsers, refer to your browser's help documentation.

Lucky.ph does not use third-party advertising cookies or behavioral tracking cookies for cross-site advertising purposes.

10Your Data Privacy Rights

Under the Data Privacy Act of 2012 and its IRR, you have the following rights with respect to your personal data processed by lucky.ph:

To exercise any of the above rights, please contact our Data Protection Officer using the details in Section 14. We will verify your identity before processing any data rights request. We will not charge a fee for exercising your rights in good faith. If you believe your rights have been violated, you may lodge a complaint with the National Privacy Commission of the Philippines.

11Children & Minors

If we discover or are notified that an Account belongs to a person under the age of 21, we will immediately close that Account, delete or quarantine the associated personal data to the extent permitted by law (some data may be retained for regulatory and fraud prevention purposes), and report the incident to PAGCOR as required. If you believe a minor has accessed or registered on lucky.ph, please notify us immediately through our support channels.

12International Data Transfers

Lucky.ph primarily stores and processes player data on servers located in the Philippines or in data centers that operate under Philippine data protection standards. Where data is processed by third-party service providers located outside the Philippines — for example, cloud infrastructure providers or game studio servers — we ensure that:

• The transfer is covered by appropriate contractual safeguards, such as data processing agreements incorporating the standard data protection clauses recognized by the National Privacy Commission;
• The recipient country or organization provides an adequate level of data protection as determined by applicable Philippine law and NPC guidance;
• The transfer is disclosed to you through this Privacy Policy as required by the Data Privacy Act.

We do not transfer KYC documents or other sensitive personal information outside the Philippines except where strictly necessary for identity verification purposes and subject to the safeguards described above.

13Changes to This Privacy Policy

Lucky.ph reserves the right to update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or PAGCOR regulatory requirements. When material changes are made, we will notify you by:

• Displaying a prominent notice on the Platform upon your next login;
• Sending a notification to your registered email address; and/or
• Sending an SMS to your registered mobile number.

The date of the most recent update is always displayed at the top of this Policy and in the "Last Updated" indicator in the table of contents sidebar. Your continued use of the Platform after an updated Privacy Policy takes effect constitutes your acceptance of the revised Policy.

We recommend reviewing this Policy periodically. If you do not agree with an updated Policy, you should stop using the Platform and contact our support team to close your Account.

14Contact & Data Protection Officer

If you have questions about this Privacy Policy, want to exercise your data privacy rights, or wish to report a potential privacy concern, you may contact lucky.ph's Data Protection Officer through the following channels:

• Live Chat: Available 24/7 from inside your logged-in lucky.ph Account — the fastest way to reach our support team for urgent privacy matters.
• Email: [email protected] — please include "Privacy Request" or "DPO" in the subject line of your message. This address is displayed as plain text only and is not a clickable link.

We aim to acknowledge all privacy-related inquiries within forty-eight (48) hours and to provide a substantive response or resolution within fifteen (15) business days. If your concern relates to a potential data breach or an urgent privacy risk, please mark your message accordingly and we will prioritize it.

If you are not satisfied with our response, you have the right to file a complaint directly with the National Privacy Commission of the Philippines, which oversees compliance with the Data Privacy Act of 2012.

This Privacy Policy was last updated on 1 January 2026. The operator of luckyph.one operates under PAGCOR authorization and complies with Republic Act No. 10173 (Data Privacy Act of 2012) and its Implementing Rules and Regulations. All rights reserved.