luckyyi Privacy Policy — How We Protect Your Personal Data

1. Scope and Data Controller

This Privacy Policy ("Policy") describes how luckyyi ("luckyyi," "the Platform," "we," "us," or "our") collects, processes, stores, and discloses personal data in connection with the operation of the luckyyi online gaming platform accessible at luckyyi.vip and all associated services.

luckyyi acts as the data controller for personal data collected through the registration process, gameplay activity, payment transactions, and customer support interactions. This Policy applies to all registered players of the luckyyi platform, visitors to the luckyyi website, and any individual whose personal data luckyyi processes in connection with its services.

This Policy is issued in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines, its Implementing Rules and Regulations, and the guidelines of the National Privacy Commission (NPC). It is read together with, and forms part of, the luckyyi Terms and Conditions.

2. Personal Data We Collect

2.1 Registration and Identity Data

When you create a luckyyi account, we collect: full legal name, date of birth, Philippine mobile number, and where provided, email address. For identity verification and KYC purposes, we may additionally collect: government-issued identification document details (e.g., PhilSys ID, passport, driver's licence), a selfie or live photograph, and proof of address documentation.

2.2 Financial and Transaction Data

To process deposits and withdrawals, luckyyi collects transaction data including: GCash mobile number, PayMaya account reference, bank account details (for BPI, BDO, or Metrobank transfers), deposit amounts, withdrawal requests, and transaction timestamps. luckyyi does not store full bank account numbers or card numbers on its own servers; payment data is handled by PCI-DSS compliant payment processing partners.

2.3 Gaming Activity Data

luckyyi records all gaming activity associated with your account, including: games played, bet amounts, session duration, win and loss history, bonus usage, and game preferences. This data is used for account management, bonus calculation, responsible gaming monitoring, and PAGCOR regulatory reporting.

2.4 Technical and Device Data

When you access luckyyi, we automatically collect: IP address, device type and model, operating system version, browser type and version, mobile network carrier, and session activity logs. This data is used for security monitoring, fraud prevention, and platform performance optimisation.

2.5 Communications Data

If you contact luckyyi support via live chat, email, or any other channel, we retain records of those communications including the content of your messages, timestamps, and the identity of the support agent who assisted you. These records are maintained for quality assurance and dispute resolution purposes.

3. How We Use Your Personal Data

luckyyi processes your personal data for the following purposes:

• Account creation and management: Registering and maintaining your luckyyi account, including authentication, account recovery, and communication of account-related information;
• Payment processing: Facilitating deposits and withdrawals through GCash, PayMaya, BPI, BDO, and Metrobank;
• Identity and age verification: Confirming that you are a legal adult (21+) resident in a jurisdiction where online gaming is lawful, in compliance with PAGCOR requirements;
• Regulatory compliance: Meeting obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act, and applicable Philippine data protection law;
• Fraud prevention and security: Detecting and preventing fraudulent transactions, account takeover attempts, and platform abuse;
• Responsible gaming: Monitoring gaming patterns to identify potential problem gambling behaviour and enforcing deposit limits, cooling-off periods, and self-exclusion requests;
• Platform improvement: Analysing anonymised usage data to improve game offerings, platform performance, and user experience;
• Marketing communications: Sending promotional offers, bonus notifications, and new game announcements to players who have not opted out.

4. Legal Basis for Processing

Under the Data Privacy Act of 2012, luckyyi processes your personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil the player agreement established upon registration, including account management and payment processing;
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, AML legislation, and National Privacy Commission guidelines;
• Legitimate interests: Processing for fraud prevention, security monitoring, and platform improvement, where such interests are not overridden by your privacy rights;
• Consent: Processing for marketing communications, where you have provided consent that you may withdraw at any time.

5. Disclosure of Personal Data

luckyyi does not sell your personal data. We may disclose personal data to the following categories of third parties, strictly on a need-to-know basis and subject to binding contractual data protection obligations:

• Payment processors: GCash (Mynt/Globe Fintech), PayMaya (Maya Bank), BPI, BDO, and Metrobank, for the purpose of processing deposits and withdrawals;
• Identity verification providers: Third-party KYC and AML screening services used to verify player identity and screen against sanction lists, as required by PAGCOR;
• Game content providers: Licensed game studios whose titles are available on luckyyi may receive anonymised session data required for game operation and RNG certification purposes;
• Regulatory authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, and other Philippine authorities, where required by law or regulatory instruction;
• IT and security service providers: Cloud hosting, cybersecurity, and fraud detection vendors operating under strict data processor agreements with luckyyi.

6. International Data Transfers

Some of luckyyi's service providers — including cloud infrastructure and game content providers — operate servers located outside the Philippines. Where personal data is transferred to a country that the National Privacy Commission has not deemed to provide an adequate level of data protection, luckyyi ensures that appropriate safeguards are in place, including standard contractual clauses and binding corporate rules as required by the Data Privacy Act and NPC regulations.

luckyyi will not transfer your personal data to a jurisdiction where it would receive a lower standard of protection than it receives under Philippine law without your informed consent or a lawful alternative transfer mechanism.

7. Data Retention

luckyyi retains personal data for the following periods:

• Account and identity data: For the duration of your luckyyi account plus five (5) years following account closure, as required by PAGCOR and AML retention obligations;
• Transaction and gaming records: Five (5) years from the date of the transaction, consistent with PAGCOR reporting requirements;
• Support communications: Two (2) years from the date of the interaction;
• Technical and device logs: Ninety (90) days for standard access logs; up to two (2) years for security incident logs;
• Marketing consent records: For the duration of your account, or until you withdraw consent.

Data retained beyond the periods above will be securely deleted or anonymised in a manner that prevents re-identification.

8. Cookies and Tracking Technologies

luckyyi uses the following categories of cookies and similar technologies on the platform:

• Strictly necessary cookies: Required for the platform to function, including session authentication tokens and security cookies. These cannot be disabled;
• Functional cookies: Remember your language preferences, display settings, and recently played games;
• Analytics cookies: Collect anonymised data about how players navigate the platform to help us improve page performance and game discovery features. This data is not linked to your personal identity;
• Security cookies: Help detect fraudulent login attempts and bot activity.

You may manage functional and analytics cookies through your browser's cookie settings. Please note that disabling certain cookies may affect platform functionality.

9. Security Measures

luckyyi implements a multi-layered security framework to protect your personal data, including:

• TLS 1.3 encryption for all data transmitted between your browser or app and luckyyi servers;
• AES-256 encryption for personal data at rest in luckyyi databases;
• Multi-factor authentication for all internal staff access to production systems containing personal data;
• Regular penetration testing and vulnerability assessments by independent third-party security firms;
• 24/7 security operations monitoring with automated alerts for anomalous access patterns;
• Role-based access controls limiting data access to employees with a documented operational need.

Notwithstanding these measures, no system is entirely immune to security incidents. In the event of a personal data breach that is likely to result in risk to your rights and freedoms, luckyyi will notify the National Privacy Commission within seventy-two (72) hours of becoming aware of the breach and will notify affected players without undue delay.

10. Your Rights as a Data Subject

Under the Data Privacy Act of 2012, as a Filipino data subject you have the following rights in relation to your personal data held by luckyyi:

• Right to be informed: The right to know what personal data luckyyi collects and how it is used — as set out in this Policy;
• Right to access: The right to obtain a copy of the personal data luckyyi holds about you, subject to identity verification;
• Right to correction: The right to request that inaccurate or incomplete personal data be corrected without undue delay;
• Right to erasure: The right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to overriding legal retention obligations;
• Right to object: The right to object to the processing of your personal data for direct marketing purposes or processing based on legitimate interests;
• Right to data portability: The right to receive your personal data in a structured, commonly used, machine-readable format;
• Right to lodge a complaint: The right to lodge a complaint with the National Privacy Commission (www.privacy.gov.ph) if you believe luckyyi has processed your personal data in violation of the Data Privacy Act.

To exercise any of the above rights, contact our Data Privacy Officer via live chat or at [email protected]. We will respond to all valid requests within fifteen (15) business days. Some requests may be subject to identity verification before processing.

11. Children and Minors

The luckyyi platform is strictly restricted to individuals aged 21 years and older. luckyyi does not knowingly collect personal data from individuals under 21 years of age. If we become aware that an account has been registered by an individual under the minimum age, we will immediately suspend the account, delete the associated personal data where legally permissible, and return any deposited funds to the payment source.

If you are a parent or guardian and believe that your child has registered a luckyyi account, please contact live support immediately. We take underage gambling extremely seriously and will act on all such reports without delay.

12. Amendments to This Policy

luckyyi reserves the right to amend this Privacy Policy at any time. Material changes — those that affect how we collect, use, or share your personal data in a way that is less favourable to you — will be communicated via the platform and your registered contact details at least seven (7) days before the change takes effect. Your continued use of luckyyi after the effective date constitutes your acknowledgement of the updated Policy. The most current version of this Policy is always accessible at luckyyi.vip/privacy-policy.

13. Contact and Data Privacy Officer

If you have any questions, concerns, or requests relating to this Privacy Policy or luckyyi's handling of your personal data, you may contact us through the following channels:

• Live Chat: Available 24/7 on the luckyyi platform — the fastest way to reach our support team;
• Email: [email protected] — for formal data rights requests, please use the subject line "Data Privacy Request".

luckyyi has appointed a Data Privacy Officer (DPO) responsible for overseeing compliance with the Data Privacy Act of 2012 and this Policy. The DPO can be reached through the same contact channels above.