luckyyi Casino —
Privacy Policy

In this Privacy Policy, the following terms carry the meanings defined below:

luckyyi Casino acts as the Data Controller in respect of all personal data collected from Members and visitors to luckyyi.club. luckyyi is responsible for ensuring that all data processing activities described in this Privacy Policy are carried out in compliance with the Philippine Data Privacy Act of 2012 (Republic Act 10173) and its Implementing Rules and Regulations, as well as applicable PAGCOR regulatory requirements governing member identification and anti-money laundering compliance.

luckyyi has appointed a Data Protection Officer (DPO) who is responsible for overseeing data privacy compliance and serving as the primary point of contact for data privacy inquiries and rights requests from Members. Contact details for the DPO are provided in Section 15 of this Privacy Policy.

luckyyi collects personal data from Members in several ways: directly when you register, verify your identity, make deposits or withdrawals, or contact our support team; automatically through your use of the Platform; and from third-party payment processors and identity verification services as part of our KYC process. The categories of data we collect are set out in the table below.

luckyyi does not collect sensitive personal information as defined under the Data Privacy Act (such as health data, political opinions, religious beliefs, or criminal records) except where expressly required by PAGCOR regulations for responsible gaming self-exclusion compliance or by applicable anti-money laundering law.

luckyyi processes your personal data only for specific, legitimate purposes. The primary purposes for which your data is used are described below:

• Account Registration and Management: To create, verify, maintain, and administer your luckyyi account, including processing your KYC documentation and confirming your eligibility to use the Platform.
• Gaming Services Delivery: To provide access to all luckyyi games and sports markets, process bets, calculate and credit winnings, and maintain your gaming and session history.
• Payment Processing: To process deposits and withdrawals via GCash, PayMaya, BPI, BDO, Metrobank, Visa, and Mastercard, and to maintain accurate financial records of all transactions.
• Fraud Prevention and Security: To detect, investigate, and prevent unauthorized account access, payment fraud, money laundering, bonus abuse, and other prohibited conduct using automated and manual review processes.
• Regulatory Compliance: To fulfill luckyyi's obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act, and other applicable Philippine laws, including maintaining the mandatory records required by these regulations.
• Customer Support: To respond to your inquiries, complaints, and support requests, and to maintain records of those interactions for quality assurance and dispute resolution purposes.
• Responsible Gaming: To monitor gaming activity patterns that may indicate problem gambling, to administer deposit limits, loss limits, cooling-off periods, and self-exclusion, and to comply with PAGCOR responsible gaming obligations.
• Platform Improvement: To analyze aggregated, anonymized usage data to improve game selection, interface performance, and the overall member experience on luckyyi.
• Marketing Communications: Subject to your consent where required, to send you promotional offers, bonus announcements, and luckyyi news via email or SMS. See Section 13 for full details on marketing communications and your opt-out rights.

Under the Philippine Data Privacy Act of 2012 and its Implementing Rules, luckyyi relies on the following legal bases for processing your personal data:

• Contractual Necessity: Processing that is necessary to perform the contract between you and luckyyi (i.e., the Terms & Conditions you accepted upon registration), including operating your account, processing transactions, and delivering gaming services.
• Legal Obligation: Processing required to comply with luckyyi's legal and regulatory obligations under PAGCOR licensing conditions, the Anti-Money Laundering Act (Republic Act 9160 as amended by Republic Act 10365), Republic Act 9487, and other applicable Philippine statutes.
• Legitimate Interests: Processing necessary for luckyyi's legitimate interests where those interests are not overridden by your fundamental rights and freedoms. This includes fraud detection and prevention, platform security, responsible gaming monitoring, and internal business analytics.
• Consent: Where luckyyi sends you direct marketing communications by email or SMS, this is done on the basis of your consent, which you may withdraw at any time as described in Section 13.

luckyyi does not sell, rent, or trade your personal data. We may share your data with third parties only in the following limited and controlled circumstances:

• Payment Processors: GCash, PayMaya, BPI, BDO, Metrobank, Visa, and Mastercard receive the financial data necessary to process your deposit and withdrawal transactions. These providers operate under their own data protection obligations and Philippine BSP regulations.
• Identity Verification Providers: Third-party KYC and biometric verification services may process your identity documents and selfie data on behalf of luckyyi to fulfill PAGCOR-mandated verification requirements. These providers act as Data Processors under contract with luckyyi.
• Game Software Providers: Game providers whose content appears on the luckyyi Platform may receive technical session data (device type, session token, game activity) necessary to deliver and authenticate gameplay. They do not receive your name, financial data, or contact information.
• Regulatory Authorities: luckyyi may be required to disclose personal data to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission, or other Philippine government agencies in response to lawful orders, regulatory inspections, or mandatory reporting obligations.
• Fraud Prevention Services: luckyyi may share limited technical and identity data with fraud prevention and risk assessment services to protect Members and the Platform from financial crime.
• Cloud and IT Infrastructure Providers: luckyyi uses cloud hosting and infrastructure providers to operate the Platform. These providers process personal data stored on luckyyi's infrastructure as Data Processors acting under strict contractual data processing agreements.

luckyyi uses cookies and similar technologies on luckyyi.club for the following purposes:

• Strictly Necessary Cookies: Required for the Platform to function correctly. These include session authentication cookies that keep you logged in, security tokens that protect your account from cross-site request forgery attacks, and load-balancing cookies. These cannot be disabled without preventing access to the Platform.
• Functional Cookies: Store your preferences such as your preferred language setting, display preferences, and responsible gaming reminder configuration. Disabling these will affect the personalized experience but will not prevent access.
• Analytical Cookies: Used by luckyyi to understand how Members use the Platform in aggregate — which games are most popular, where navigation issues occur, and how page performance can be improved. Analytics data is processed in aggregated, anonymized form.

luckyyi does not use third-party advertising or behavioral tracking cookies. You may manage cookie preferences through your browser settings. Please note that disabling strictly necessary cookies will impair Platform functionality and may prevent you from logging in to your luckyyi account.

luckyyi implements appropriate technical and organizational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:

• TLS 1.3 encryption for all data in transit between your device and the luckyyi Platform.
• AES-256 encryption for personal and financial data stored at rest on luckyyi servers.
• Bcrypt hashing for all stored Member passwords. luckyyi staff cannot read your password.
• Role-based access controls ensuring that luckyyi employees can only access the personal data they need to perform their specific job functions.
• Comprehensive access logging and regular audits of all internal access to Member data.
• Two-factor authentication available for all Member accounts and required for all luckyyi administrative access.
• Regular penetration testing and security vulnerability assessments by independent cybersecurity professionals.

In the event of a personal data breach that is reasonably likely to give rise to a real risk of serious harm to Members, luckyyi will notify the National Privacy Commission and affected Members within 72 hours of becoming aware of the breach, in accordance with the Data Privacy Act and NPC Circular 16-03.

luckyyi retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal retention obligations. The following retention periods apply:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized using industry-standard data destruction methods. Anonymized, aggregated data that cannot be linked back to any individual may be retained indefinitely for Platform analytics purposes.

As a data subject under the Philippine Data Privacy Act of 2012, you hold the following rights in respect of your personal data processed by luckyyi. All rights requests should be submitted to luckyyi's Data Protection Officer at the contact details in Section 15. luckyyi will respond within thirty (30) calendar days of receiving a valid request.

The luckyyi Platform is strictly intended for adults aged 21 years and older. luckyyi does not knowingly collect personal data from any person under the age of 21. All registration applicants are required to submit a valid Philippine government ID during KYC verification, which confirms the applicant's date of birth and establishes that they meet the minimum age requirement.

If luckyyi becomes aware that an Account has been registered by a person under 21 years of age, that Account will be immediately suspended, any real-money balances will be returned to the payment source, and all personal data associated with the Account will be deleted without delay, subject only to any mandatory regulatory reporting obligations that may apply.

luckyyi's primary data processing infrastructure is located within the Philippines or in data centers that operate under data protection standards equivalent to those required by the Philippine Data Privacy Act. Certain service providers used by luckyyi, including game software providers and cloud infrastructure partners, may process data in jurisdictions outside the Philippines.

Where personal data is transferred outside the Philippines, luckyyi ensures that appropriate safeguards are in place, including:

• Contractual data processing agreements incorporating the standard data protection clauses recognized by the National Privacy Commission.
• Transfer only to countries or organizations that the NPC has recognized as providing an adequate level of data protection.
• Your prior consent where required by the NPC's cross-border transfer rules.

You may request information about the specific safeguards in place for any particular cross-border transfer by contacting luckyyi's Data Protection Officer.

With your consent, luckyyi may send you promotional communications about new games, bonuses, reload offers, seasonal promotions, and platform news via SMS to your registered Philippine mobile number or via email to your registered address. You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your luckyyi Account Settings under the Notifications section.
• Clicking the unsubscribe link included in any luckyyi marketing email.
• Replying "STOP" to any luckyyi promotional SMS.
• Contacting luckyyi's support team directly and requesting removal from marketing communications.

Withdrawal of marketing consent will not affect your ability to use the luckyyi Platform or your account. You will continue to receive transactional communications — such as deposit confirmations, withdrawal notifications, and security alerts — which are necessary for the operation of your account and are not subject to marketing opt-out.

luckyyi may update this Privacy Policy from time to time to reflect changes in applicable law, changes in our data processing activities, or regulatory guidance from the National Privacy Commission or PAGCOR. The effective date at the top of this document reflects the date of the most recent revision.

Where changes to this Privacy Policy are material — that is, where they significantly affect how we process your personal data or your rights in respect of that data — luckyyi will provide advance notice to Members via their registered email address at least fourteen (14) calendar days before the changes take effect. Non-material corrections and clarifications may be published without prior notice.

Your continued use of the luckyyi Platform after a revised Privacy Policy has taken effect constitutes your acknowledgment of the revised terms. If you do not agree with any revision, you should cease using the Platform and may request Account closure in accordance with the Terms & Conditions.

For all data privacy inquiries, rights requests, or complaints relating to luckyyi's handling of your personal data, please contact our Data Protection Officer:

Please note that email addresses in this document are displayed as plain text and are not clickable links. If you wish to submit a formal data privacy complaint that cannot be resolved by luckyyi directly, you have the right to escalate to the National Privacy Commission of the Philippines, which operates the official complaints process under the Data Privacy Act of 2012.