Lucky99 Privacy Policy — How We Handle Your Personal Data

This Privacy Policy applies to all personal data processed by lucky99 in connection with the operation of the lucky99 online casino and sportsbook platform. It covers data collected when you visit the website, register an account, complete KYC verification, make a deposit or withdrawal via Malaysian payment methods, place a wager, claim a promotional bonus, contact customer support, or interact with lucky99 in any other way.

References to lucky99, "we", "us", or "our" mean the operator responsible for the lucky99 platform. References to "you", "your", or "player" mean the individual whose personal data is being processed. References to "personal data" mean any information relating to an identified or identifiable natural person.

This policy should be read alongside the lucky99 Terms & Conditions and the Responsible Gambling policy. The lucky99 platform and all data processing activities operate in accordance with applicable data protection requirements. We review and update this policy periodically; the effective date at the top of this page reflects the most recent version.

lucky99 collects personal data from you directly when you provide it — for example, during registration or KYC — and automatically when you use the platform, such as through device and usage logs. We may also receive information from third parties such as payment providers, fraud-prevention services, and identity verification partners. The categories of data we may process are summarised below.

You are not required to provide all categories of data. However, some data is necessary for core platform functions — for example, identity data for KYC and payment data for deposits and withdrawals. Withholding required data may limit the services lucky99 is able to provide.

lucky99 processes personal data only where a lawful basis applies. The primary bases we rely on are:

• Contract performance: Processing necessary to create, operate, and administer your lucky99 account, process MYR deposits and withdrawals, settle wagers, and provide the services you have requested.
• Legal obligation: Processing required to comply with applicable laws and regulations, including identity verification, age confirmation, anti-money-laundering obligations, record-keeping requirements, and responses to lawful authority requests.
• Legitimate interests: Processing for fraud prevention, account security, responsible gambling monitoring, platform analytics, system testing, and protection of players and the integrity of lucky99. Where we rely on legitimate interests, we balance those interests against your rights and expectations.
• Consent: Where you have given freely provided, informed, specific, and withdrawable consent — for example, for certain marketing communications. You may withdraw consent at any time by contacting support, without affecting prior processing.

Where processing is based on legitimate interests, you may object to that processing. We will consider your objection and respond, explaining whether it can be honoured and, if not, why our interests override your objection in the specific circumstances.

Personal data collected by lucky99 is used for the following purposes. We do not process data for purposes incompatible with those listed here without providing a further notice.

• Account creation and management: Registering your profile, maintaining your account settings, communicating service updates, and managing your responsible gambling tool preferences.
• Identity and age verification: Confirming that you are aged 21 or above, that your identity documents are genuine, and that your payment methods belong to you.
• Payment processing: Handling deposits and withdrawals via Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, DuitNow, FPX, and USDT TRC20; reconciling transactions; and investigating disputed or failed payments.
• Game and betting services: Recording wagers, settling results for markets including EPL, Liga Super Malaysia, UFC, and other events, crediting winnings, and managing bonus accounts.
• Fraud and security: Detecting and preventing fraudulent transactions, chargeback abuse, collusion, duplicate accounts, bot activity, and other prohibited conduct under the lucky99 Terms & Conditions.
• Responsible gambling: Monitoring activity for indicators of problem gambling, applying player-requested limits and self-exclusion, and fulfilling any enhanced player-protection obligations.
• Regulatory compliance: Meeting anti-money-laundering, counter-terrorism financing, record-keeping, and any other applicable legal requirements.
• Customer support: Responding to queries, resolving complaints, and maintaining support records.
• Platform improvement: Analysing aggregated usage data to improve performance, reliability, game selection, and the overall lucky99 player experience.
• Marketing communications (where consented): Sending promotional offers, bonus announcements, and service updates where you have opted in and not subsequently withdrawn consent.

lucky99 uses cookies and similar technologies to operate the platform, remember your session, prevent fraud, and understand how players use the site. Cookies are small data files placed on your device when you access lucky99.

• Strictly necessary cookies: Essential for authentication, session management, and security. These cannot be disabled without significantly impairing platform function.
• Functional cookies: Remember your preferences such as language settings, responsible gambling tool states, and last-login device.
• Analytics cookies: Collect aggregated, anonymised data about how players navigate lucky99 so we can improve the platform. Individual identifiers are not shared externally through these cookies.
• Security and fraud-prevention cookies: Help detect unusual access patterns, bot activity, and other threats to account security.

You can manage cookie preferences through your browser settings. Disabling strictly necessary cookies will impair login and payment functions. Please note that third-party game studios embedded within lucky99 may set their own cookies subject to those parties' separate policies — lucky99 has no control over third-party cookie behaviour.

lucky99 does not sell personal data. We may share your data with the categories of recipient below, strictly for the purposes described in this policy:

• Payment processors and e-wallet providers: Touch 'n Go eWallet, Boost, GrabPay, Maybank, CIMB, Public Bank, Hong Leong Bank, DuitNow, FPX, and cryptocurrency settlement partners receive the transaction data necessary to complete your deposit or withdrawal.
• KYC and identity verification services: Third-party providers that perform automated or manual document checking and age-verification checks on behalf of lucky99.
• Anti-fraud and AML screening services: Services that screen transactions and accounts against sanctions lists, politically exposed person databases, and fraud signals.
• Game studio technology partners: Providers whose game engines are integrated into lucky99 receive session tokens and wager data necessary to operate the game. They do not receive full identity or payment records.
• IT infrastructure and cloud service providers: Hosting, database, backup, and security service providers operating under data processing agreements.
• Legal and regulatory authorities: Law enforcement agencies, courts, financial intelligence units, and regulators where disclosure is required by law, court order, or lawful authority request.
• Professional advisers: Lawyers, auditors, and compliance consultants where access is necessary for specific professional services.

Where personal data is transferred to processors outside Malaysia, lucky99 uses contractual safeguards to ensure an adequate level of protection equivalent to applicable requirements.

lucky99 implements layered technical and organisational safeguards to protect personal data against unauthorised access, accidental loss, destruction, alteration, and disclosure. The main measures in place include:

• TLS/SSL 256-bit encryption for all data transmitted between your device and lucky99 servers.
• At-rest encryption for stored personal data, including KYC documents and payment records.
• Strict internal access controls: personal data is accessible only to authorised staff members with a documented business need.
• Two-factor authentication available on all player accounts and required for internal administrative access.
• Regular security assessments, penetration testing, and vulnerability reviews by qualified personnel.
• Secure document upload workflows — KYC files must be submitted through official lucky99 HTTPS pages only, not via WhatsApp, Telegram, or other unencrypted third-party channels.
• Incident response procedures including breach identification, containment, and notification processes.

Despite these measures, no internet transmission or electronic storage method is entirely risk-free. You should also take steps to protect your own account — use a strong, unique password, enable two-factor authentication, and notify lucky99 immediately if you suspect unauthorised access to your account.

lucky99 retains personal data for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention principles apply:

• Active account data: Retained throughout the period your account is open and active, subject to ongoing operational need.
• Transaction and payment records: Retained for a minimum of five years after the transaction date to satisfy financial record-keeping and AML obligations.
• KYC and identity verification records: Retained for a minimum of five years following account closure or the last transaction, whichever is later, in accordance with applicable requirements.
• Support and communications logs: Retained for up to three years from the date of the interaction to enable dispute resolution and quality review.
• Session and analytics data: Aggregated analytics may be retained indefinitely in de-identified form. Individual session logs are retained for security review purposes for up to 12 months.
• Self-exclusion records: Retained for the duration of the exclusion and for a defined period thereafter to support re-registration reviews and prevent circumvention.

When data is no longer required, lucky99 securely deletes or anonymises it in a manner that prevents reconstruction of the original personal data.

Subject to applicable law and certain legitimate exceptions, you hold the following rights in relation to your personal data processed by lucky99. To exercise any of these rights, contact lucky99 support using the details in Section 12.

Requests will be acknowledged promptly and substantively addressed within a reasonable timeframe. Where a right cannot be honoured in full, lucky99 will explain the reason. Identity verification may be requested before a right can be actioned to prevent unauthorised disclosure.

lucky99 is strictly prohibited to persons under the age of 21. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe that a minor has submitted personal data to lucky99 or created an account, please contact support immediately. Upon confirmation, we will take prompt action to remove the data and close the account.

lucky99's KYC identity verification process is designed to prevent underage access. Players who cannot provide satisfactory age and identity evidence will not be permitted to deposit, wager, or withdraw. Lucky99 may also request additional age-verification at any point during the account lifecycle where it has reason to doubt a player's age.

lucky99 may update this Privacy Policy from time to time to reflect changes in data processing practices, platform functionality, applicable requirements, or best practice guidance. Material changes will take effect from the updated effective date shown at the top of this page.

Where a change significantly affects your rights or how we process your data, we will take reasonable steps to notify registered players — for example, by displaying a notice within the platform or sending a communication to the registered email address. Continued use of lucky99 after the effective date of a revised policy constitutes acceptance of the updated terms, except where your explicit consent is required by applicable law.

We recommend reviewing this page periodically to remain informed. The effective date at the top of this document will always reflect the current version. If you have questions about a recent change, contact lucky99 support for clarification.

All privacy-related queries, data access requests, correction submissions, erasure requests, objections, and consent withdrawals should be directed to lucky99 support. Please provide your registered account username and a description of your request. To protect your data, we may verify your identity before processing a request.

Email: [email protected]
Live Chat: Available 00:00–23:59 daily via the lucky99 platform — including all Malaysian public holidays
Average first-response time: Under 2 minutes via live chat; email responses within 4–12 hours

Where a request relates to data held by a specific payment provider (such as Maybank, CIMB, Public Bank, Touch 'n Go eWallet, or another Malaysian bank), lucky99 will assist where possible but may direct you to the provider for data held under their independent responsibility.