Lucky97 Privacy Policy – How We Protect Your Data in Pakistan

This Privacy Policy explains how Lucky97 ("Lucky97", "we", "us", "our"), the operator of the online gaming platform at lucky97.click, collects, uses, stores and shares personal data relating to registered players and visitors to the platform ("you", "your").

Lucky97 is built specifically for Pakistani players and operates entirely within a Pakistani context — PKR wallets, Pakistani payment methods, Pakistani contact numbers and Pakistani identity documents. This policy reflects that context and is written specifically for users in Pakistan.

By creating a Lucky97 account or using the platform, you confirm that you have read and understood this Privacy Policy. This policy should be read alongside our Terms and Conditions and Responsible Gaming policy. If you have any questions that this document does not answer, contact us at support@lucky97.click — we respond clearly and without corporate jargon.

Lucky97 collects personal data in three ways: data you provide directly when registering or using the platform, data we collect automatically as you use the platform, and data we receive from third-party payment processors during transaction verification.

Lucky97 does not collect sensitive personal data such as biometric information, health data or political opinions. We also do not knowingly collect data from persons under the age of 18.

Every piece of data Lucky97 holds about you is used for a defined purpose. We do not collect data speculatively. The purposes for which we process your personal data are:

• Account creation and management — creating your Lucky97 account, verifying your identity and maintaining your account profile
• Processing PKR transactions — handling deposits and withdrawals via Easypaisa, JazzCash, NayaPay, SadaPay, bank IBFT and Visa/Mastercard
• Providing gaming services — operating the games you play and maintaining your game history and balance
• KYC and fraud prevention — verifying your identity in compliance with our anti-money laundering and know-your-customer obligations
• Customer support — responding to your questions, resolving disputes and handling complaints
• Responsible gaming — monitoring for patterns that may indicate problem gambling and administering your responsible gaming settings
• Platform improvement — analysing how players use Lucky97 to improve performance, fix issues and develop new features
• Marketing communications — sending you information about promotions and offers at Lucky97 where you have consented to receive such communications
• Legal compliance — meeting regulatory and legal obligations applicable to the operation of an online gaming platform

Lucky97 processes your personal data on the following legal grounds depending on the specific activity:

• Performance of contract — most of our processing, including account management and transaction processing, is necessary to perform the service you have agreed to when registering on Lucky97
• Legal obligation — KYC identity verification, transaction records and anti-money laundering checks are carried out because we are legally required to do so
• Legitimate interests — fraud detection, platform security monitoring and platform performance analytics are carried out on the basis of our legitimate interest in operating a secure and well-functioning platform
• Consent — marketing communications are sent only where you have given explicit consent. You may withdraw this consent at any time without affecting anything else

Lucky97 does not sell, rent or trade your personal data to any third party for commercial purposes. Your data may be shared with the following categories of third party only where strictly necessary:

• Payment processors — Easypaisa, JazzCash, NayaPay, SadaPay and bank partners receive the minimum data necessary to process your transactions (e.g., your mobile wallet number for an Easypaisa withdrawal)
• Game software providers — providers of the games available on Lucky97 may receive anonymised session data for the purpose of operating the game. They do not receive your identity data or payment details
• KYC and identity verification partners — we use verified third-party services to validate identity documents. These partners process your KYC data under strict confidentiality agreements
• Legal and regulatory authorities — Lucky97 will share data with law enforcement or regulatory bodies where required to do so by law, court order or in connection with a genuine investigation of suspected illegal activity
• Technology infrastructure providers — hosting, security and analytics providers who support the operation of the Lucky97 platform. All such providers are bound by data processing agreements and are not permitted to use your data for their own purposes

All third parties who process Lucky97 player data on our behalf are contractually bound to handle that data securely, use it only for the specified purpose and not retain it beyond the period necessary to complete the relevant service.

Because Lucky97 operates as a real-money gaming platform processing PKR transactions, we are required to carry out Know Your Customer (KYC) verification for all accounts before withdrawal. This is a legal and operational requirement, not optional, and is designed to protect both players and the platform from fraud and financial crime.

KYC verification at Lucky97 typically requires:

• A copy of a valid Pakistani identity document — CNIC or passport
• A selfie or photograph confirming you are the person named on the identity document, where additional verification is required
• Proof of ownership of the payment method being used for withdrawal, such as a screenshot of your Easypaisa or JazzCash account in your name

KYC documents submitted to Lucky97 are stored securely with encryption at rest and are accessible only to authorised team members on a need-to-know basis. Documents are used exclusively for identity verification and anti-money laundering compliance. They are not shared with any commercial third party.

Payment data — specifically your Easypaisa number, JazzCash number, IBFT account details or card last-four digits — is stored to facilitate withdrawals and to enforce the Lucky97 policy of returning funds to the same method used for the most recent deposit. Full card numbers and payment credentials are never stored on Lucky97 servers; payment processing is handled by certified payment gateway partners.

Lucky97 uses cookies and similar tracking technologies to make the platform work correctly and to understand how players use it. The types of cookies used on Lucky97 are:

Lucky97 does not use third-party advertising cookies or behavioural targeting cookies that profile you across other websites. You can manage cookie preferences through your browser settings, though disabling essential cookies may prevent parts of Lucky97 from working correctly.

Lucky97 operates a multi-layered security architecture to protect player data. The following controls are in place across the platform at all times:

Despite these measures, no internet-based system can guarantee absolute security. If you have reason to believe your Lucky97 account has been accessed without your authorisation, contact us immediately at support@lucky97.click or via live chat so we can take protective action without delay.

Lucky97 maintains an internal data breach response plan. In the event of a data breach that poses a risk to player data, we will notify affected players through their registered contact details as promptly as the circumstances allow and take immediate steps to contain and investigate the incident.

Lucky97 retains personal data only for as long as it is needed for the purposes described in this policy or to meet legal obligations. The general retention approach is:

• Active account data — retained for the lifetime of your Lucky97 account and for a period of up to five years after account closure, in order to meet anti-money laundering record-keeping requirements
• Transaction records (PKR deposits, withdrawals, bet history) — retained for five years from the date of the transaction in accordance with financial record-keeping obligations
• KYC documents — retained for the period required by applicable law, typically five years from the date of verification
• Support communications — retained for two years from the date of the last interaction unless a longer period is needed for an ongoing dispute
• Marketing consent records — retained for as long as you have an active Lucky97 account or until you withdraw consent
• Technical and usage logs — typically retained for 12 months for platform performance and security purposes

When the retention period for any category of data expires and there is no ongoing legal reason to retain it, Lucky97 securely deletes or anonymises that data so it can no longer be linked to you.

As a Lucky97 player, you have the following rights in relation to your personal data. You can exercise any of these rights by writing to support@lucky97.click. We will respond within 30 days — and usually much sooner.

Lucky97 is strictly for players aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. Registration requires provision of a date of birth, and KYC verification confirms age against identity documents. If Lucky97 discovers that an account has been registered by a person under 18, the account will be closed immediately, all data associated with it will be deleted (except records required by law) and any deposited funds will be returned to the payment method.

If you are a parent or guardian and believe your child has registered an account on Lucky97, please contact us immediately at support@lucky97.click with the relevant details and we will investigate and take action without delay.

Lucky97 may update this Privacy Policy from time to time to reflect changes in how we operate, changes in the services we offer or changes in applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page and notify registered players via their registered contact details.

Continued use of Lucky97 following notification of a policy change constitutes acceptance of the updated policy. If you do not agree with a change, you should stop using the platform and, if you wish, request closure of your account and deletion of your data in accordance with Section 10.

Minor changes — such as clarifications that do not change the substance of how your data is used — may be made without active notification but will always be reflected in an updated "Last Updated" date on this page.

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how Lucky97 handles your personal data, please contact us through the following channels:

• Email: support@lucky97.click — include "Privacy" in your subject line for faster routing
• Live Chat: Available 24/7 within the Lucky97 platform — fastest response for urgent account security matters
• Languages: We can handle privacy requests in both English and Urdu

Lucky97 aims to respond to all privacy-related enquiries within 30 days and typically responds much faster. For requests to access, correct or delete your data, we may need to verify your identity before processing the request — this is to protect you and ensure we are responding to the right person.