luk33 Privacy Policy — How We Protect Your Data

This Privacy Policy describes how luk33 ("luk33", "we", "us", "our") collects, uses, stores, and protects the personal data of individuals ("you", "your", "player") who use the luk33 platform at luk33.org, including its website, mobile web interface, and any associated services.

This policy applies to all players based in Pakistan and to any individual who interacts with luk33 regardless of the device or method used to access the platform. It applies from the moment you visit luk33.org — even before you create an account.

luk33 is committed to processing personal data in a lawful, fair, and transparent manner. We align our data practices with internationally recognised data protection principles, including those set out in the General Data Protection Regulation (GDPR) where applicable, and the data protection requirements of our gaming licensing jurisdiction.

luk33 is the data controller responsible for the personal data collected through the luk33 platform. As data controller, luk33 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection law and our licensing obligations.

luk33 operates under an internationally recognised gaming licence. The licensing authority under which luk33 is regulated also imposes data protection and player privacy obligations that supplement the commitments made in this Privacy Policy.

If you have any questions about how luk33 handles your personal data, or wish to exercise any of your data rights described in Section 11 of this policy, please contact our Data Protection team via the support channels listed in Section 16.

luk33 collects the following categories of personal data from players and prospective players:

Identity Data: Full legal name as it appears on your government-issued ID, Computerised National Identity Card (CNIC) number, date of birth, nationality, and gender. This data is mandatory for account registration and KYC compliance.

Contact Data: Pakistani mobile number (for JazzCash/EasyPaisa linkage and OTP verification), email address, and residential address in Pakistan (city, province, postal code). We use this data to communicate with you about your account, transactions, and any important security updates.

Financial Data: Deposit and withdrawal transaction records, payment method identifiers (e.g., your JazzCash or EasyPaisa mobile number, HBL or UBL bank account name — we do not store full bank account numbers directly), and account balance history. All financial data is retained to meet Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) regulatory requirements.

Identity Verification Documents: Scans or photographs of your CNIC (front and back), passport, or other government-issued ID, along with supporting proof-of-address documents. These are collected as part of the mandatory KYC process before withdrawal processing.

Technical and Device Data: IP address, device identifier, browser type and version, operating system, screen resolution, time zone, and referring URL. This data is collected automatically when you access luk33.org and is used for security monitoring and fraud prevention.

Behavioural and Usage Data: Games played, bet amounts and outcomes, session start and end times, features accessed, and navigation paths within the platform. This data supports our responsible gaming monitoring obligations and helps us understand how Pakistani players use the platform.

Communications Data: Records of all communications you have with luk33 support, including live chat transcripts, email correspondence, and complaint submissions. These are retained for dispute resolution and regulatory audit purposes.

luk33 collects personal data through the following channels:

• Direct submission: Data you provide when creating an account, completing KYC verification, making a deposit or withdrawal request, contacting support, or filling in any form on the luk33 platform.
• Automated collection: Technical and usage data collected automatically via server logs, session tracking, and first-party cookies when you browse luk33.org.
• Payment providers: Transaction confirmation data received from JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, and other payment partners when you initiate a deposit or withdrawal. luk33 receives only the information necessary to confirm and record the transaction.
• Identity verification partners: Where luk33 uses a third-party KYC service to verify the authenticity of identity documents, that service may return a verification result to luk33. The underlying documents remain subject to the data handling terms of that service provider, which luk33 vets for compliance.
• Fraud prevention services: luk33 may receive risk signals from fraud detection partners relating to IP reputation, device fingerprint, and known bad-actor databases. These signals are used solely for account security purposes.

luk33 uses the personal data we hold about you for the following purposes:

• Account Management: Creating, maintaining, and administering your luk33 player account, including processing login requests, updating profile details, and managing account preferences.
• Transaction Processing: Receiving deposits from and sending withdrawals to your registered Pakistani payment methods (JazzCash, EasyPaisa, bank transfer, etc.).
• KYC & Age Verification: Verifying that you are who you claim to be and that you are aged 21 or above before processing withdrawals or granting access to higher transaction limits.
• Regulatory Compliance: Meeting luk33's AML, CTF, responsible gaming monitoring, and player fund segregation obligations under our gaming licence.
• Security & Fraud Prevention: Detecting and preventing unauthorised account access, bonus abuse, multi-accounting, money laundering, and other fraudulent or prohibited activity.
• Responsible Gaming: Monitoring player behaviour to identify signs of problem gambling, enforcing self-exclusion and deposit limit requests, and intervening proactively where a player's usage pattern indicates potential harm.
• Customer Support: Responding to queries, resolving disputes, processing complaints, and providing assistance via live chat or email.
• Platform Improvement: Analysing aggregated, anonymised usage data to improve the luk33 platform, optimise game offerings, and enhance the user experience for Pakistani players.
• Marketing Communications: Sending you promotional offers, bonus notifications, and gaming updates via email or SMS, but only where you have given explicit consent to receive such communications. You may withdraw consent at any time.

luk33 relies on the following legal bases to process your personal data. Each processing activity is associated with at least one of these bases:

• Performance of a Contract: Processing necessary to create and operate your account, process transactions, and deliver the luk33 gaming service you have signed up for.
• Legal Obligation: Processing required to comply with AML/CTF law, gaming licence conditions, KYC requirements, tax reporting obligations, and any lawful requests from regulatory authorities or law enforcement agencies.
• Legitimate Interests: Processing necessary for fraud prevention, account security, platform analytics, and responsible gaming monitoring — provided these interests are not overridden by your data protection rights. We conduct a balancing test before relying on legitimate interests.
• Consent: Processing for direct marketing communications and any non-essential cookie use. You may withdraw consent at any time by contacting support or adjusting your account communication preferences. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

luk33 does not sell, rent, or trade your personal data. We share personal data with third parties only in the following circumstances and only to the extent necessary for the stated purpose:

• Payment Providers: JazzCash, EasyPaisa, Raast, 1LINK, HBL, UBL, Meezan Bank, Allied Bank, SadaPay, and USDT processors receive the minimum data necessary to process your deposit or withdrawal transaction.
• KYC & Identity Verification Partners: Where luk33 uses a third-party verification service to check the authenticity of your identity documents, your identity data and document images are shared with that provider under a strict data processing agreement.
• Game Providers: Third-party game studios and live dealer providers that supply games on the luk33 platform may receive your player ID and gameplay session data necessary to deliver and record game results. They do not receive your name, financial data, or contact details unless specifically required for a prize fulfilment purpose.
• Fraud Prevention & Security Services: Specialist fraud detection and cybersecurity providers receive technical data (IP address, device fingerprint) to help luk33 detect and prevent fraudulent activity.
• Regulatory Authorities: luk33's gaming licensing authority may request access to player data as part of its regulatory oversight function. luk33 is obligated to cooperate with such requests.
• Law Enforcement: Where luk33 receives a lawful order, subpoena, or court order from a competent authority, we will disclose the minimum personal data required to comply with that legal obligation.
• Professional Advisers: Lawyers, auditors, and accountants engaged by luk33 may have access to personal data where strictly necessary for the professional service being provided, subject to professional confidentiality obligations.

luk33 is an internationally operated platform and some of our data processing partners — including cloud infrastructure providers, KYC services, and game providers — may be located outside Pakistan. Where personal data is transferred to a country that does not have an equivalent level of data protection law, luk33 ensures appropriate safeguards are in place, which may include:

• Standard Contractual Clauses (SCCs) approved by a recognised data protection authority.
• Binding corporate rules where the recipient is part of the same corporate group.
• A documented adequacy assessment confirming the recipient jurisdiction offers sufficient protection.

You may request information about the specific safeguards applied to international transfers of your personal data by contacting luk33 support.

luk33 uses cookies and similar tracking technologies on luk33.org. Cookies are small text files stored on your device by your browser that help the platform function correctly and enable luk33 to understand how the site is used.

luk33 uses the following categories of cookies:

• Strictly Necessary Cookies: Essential for the platform to function. These include session authentication cookies, CSRF protection tokens, and load balancing cookies. These cannot be disabled without affecting your ability to use the platform.
• Functional Cookies: Remember your preferences such as language settings, preferred payment method, and responsible gaming tool configurations. These improve your experience but are not strictly required.
• Analytics Cookies: First-party analytics cookies that help luk33 understand which pages are visited most frequently, how players navigate the site, and where technical issues occur. Data is aggregated and anonymised. luk33 does not use Google Analytics or other third-party analytics services that share data with external companies.
• Security Cookies: Used to detect and prevent fraudulent account activity, including bot detection and multi-account identification.

You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will affect your ability to log in and use the platform. A cookie preference panel is also accessible via the luk33 platform settings.

luk33 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law and licensing obligations. The following retention periods apply:

• Account and Identity Data: Retained for a minimum of five years after account closure to satisfy AML record-keeping obligations imposed by luk33's licensing authority.
• Financial Transaction Records: Retained for a minimum of five years from the date of each transaction, in accordance with AML/CTF and gaming licence requirements.
• KYC Documents: Retained for a minimum of five years after the KYC verification was completed, or five years after account closure, whichever is later.
• Support Communications: Retained for three years after the closure of the relevant support case, or longer if the case relates to an unresolved dispute or regulatory matter.
• Marketing Preference Records: Retained for two years after your last interaction with a marketing communication, or until you withdraw consent, whichever comes first.
• Technical and Device Data: Server logs are retained for 90 days for security monitoring purposes, then automatically purged unless flagged for a security investigation.

luk33 respects your rights over your personal data. The following rights are available to you as a luk33 player:

• Right of Access: You may request a copy of the personal data luk33 holds about you, along with information about how it is being used.
• Right to Rectification: You may request correction of any personal data that is inaccurate or incomplete. Some data (such as your registered name and date of birth) can only be corrected with supporting KYC documentation.
• Right to Erasure: You may request deletion of your personal data in certain circumstances — for example, where the data is no longer needed for the purpose it was collected. This right is subject to overriding legal retention obligations (see Section 10).
• Right to Restriction: You may request that luk33 restrict processing of your personal data in certain circumstances — for example, while a rectification request is being resolved.
• Right to Data Portability: You may request that luk33 provide your personal data in a structured, commonly used, machine-readable format for transfer to another service provider.
• Right to Object: You may object to luk33 processing your personal data on the basis of legitimate interests. luk33 will stop such processing unless it can demonstrate compelling legitimate grounds that override your interests.
• Right to Withdraw Consent: Where processing is based on consent (e.g., marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of prior processing.

To exercise any of the above rights, please contact luk33 support via live chat or email (see Section 16). luk33 will respond to all data rights requests within 30 calendar days. We may need to verify your identity before fulfilling a request.

The luk33 platform is strictly intended for adults aged 21 years and above. luk33 does not knowingly collect personal data from individuals under the age of 21, and it is a condition of use of the platform that you confirm you are 21 or older at the point of registration.

If you are a parent or guardian and believe that a minor has accessed or registered on luk33, please contact our support team immediately so that we can investigate and take appropriate action without delay.

luk33 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Our security infrastructure includes:

• Transport Layer Security (TLS 1.3): All data in transit between your device and luk33 servers is encrypted using TLS 1.3.
• AES-256 Encryption at Rest: Sensitive stored data — including identity documents, financial records, and account credentials — is encrypted at rest using AES-256 standards.
• Two-Factor Authentication (2FA): luk33 supports and encourages the use of 2FA on all player accounts to prevent unauthorised login.
• Access Controls: Internal access to player personal data is restricted to luk33 staff with a documented business need. All access is logged and audited.
• Regular Security Audits: luk33 conducts regular vulnerability assessments and penetration tests on its platform infrastructure.
• Data Minimisation in Internal Systems: Internal dashboards used by support staff display masked versions of sensitive data (e.g., only the last four digits of a payment method) where full data is not required for the task.

While luk33 takes all reasonable steps to protect your data, no internet transmission or electronic storage system is 100% secure. You are responsible for keeping your account password confidential and for notifying luk33 immediately if you suspect unauthorised access to your account.

luk33 may send you promotional emails, SMS messages, or in-platform notifications about bonuses, new games, PSL cricket betting markets, special offers, and platform updates — but only where you have given your explicit consent to receive such communications at the time of registration or subsequently through your account settings.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email luk33 sends you.
• Updating your communication preferences in your luk33 account settings panel.
• Contacting luk33 support via live chat and requesting removal from marketing lists.

Withdrawal of marketing consent does not affect your ability to use the luk33 platform or receive transactional communications (such as deposit confirmations, withdrawal notifications, or security alerts) which are sent on the basis of contract or legitimate interest, not consent.

luk33 may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or platform features. When we make material changes — that is, changes that meaningfully affect how your personal data is used or your rights over it — we will notify you by:

• Posting a prominent notice on the luk33 platform for a minimum of 30 days before the change takes effect.
• Sending an email notification to the address registered on your luk33 account.

For non-material changes (such as grammatical corrections, clarifications that do not alter meaning, or updates to contact details), luk33 will update the policy and revise the "Last Reviewed" date at the top of this page without advance notification.

Your continued use of the luk33 platform after a material change takes effect constitutes your acceptance of the updated Privacy Policy. If you do not agree with the updated policy, you should cease using the platform and contact support to request account closure.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how luk33 has handled your personal data, please contact our Data Protection team through the following channels:

• Live Chat: Available 24/7 directly on the luk33 platform. This is the fastest way to reach us for urgent data-related concerns.
• Email: [email protected] — please use the subject line "Data Protection Request" so your message is routed to the correct team.

luk33 will acknowledge all data protection enquiries within 72 hours and aim to resolve them fully within 30 calendar days. Complex requests — such as large data access requests or disputes involving multiple processing activities — may take up to 60 days, in which case luk33 will inform you of the extended timeline and the reason for it.