Lucky 97 Privacy Policy – How We Protect Your Data

Lucky 97 operates the online gaming platform available at lucky97.bio. As the operator of this platform, Lucky 97 is the data controller responsible for the personal information you share with us when you register, deposit, play, or contact our support team.

This Privacy Policy explains in plain terms what personal data we collect from Pakistani users of the Lucky 97 platform, the reasons we collect it, how we use and protect it, how long we keep it, and what rights you have over your own information. We have written this policy to be genuinely readable — not as a legal obstacle but as a real explanation of our practices.

Lucky 97 does not sell, rent, or trade your personal data to third parties for their own marketing purposes. This is a firm commitment and not a clause that changes depending on circumstances. The only sharing of data that takes place is what is strictly necessary to operate the platform and comply with applicable legal obligations, as described in Section 5 of this policy.

If you have any questions about how Lucky 97 handles your data — at any point, before or after registering — you can reach our support team at support@lucky97.bio. We try to answer data-related queries within 24 hours.

Lucky 97 collects personal data through three channels: information you provide directly, information generated through your use of the platform, and information obtained through identity verification processes. Here is a full breakdown of each category:

Information You Provide Directly

• Full legal name as it appears on your CNIC or other valid identity document.
• Date of birth, for the purpose of age verification.
• Pakistani mobile number, used for account authentication and transactional notifications.
• Email address, used for account communications, promotional messages (where opted in), and support correspondence.
• Residential address in Pakistan, collected during identity verification.
• CNIC number and a copy of the document, submitted during KYC (Know Your Customer) verification.
• Payment method details — these are processed via secure payment gateways (Easypaisa, JazzCash, NayaPay, SadaPay, IBFT, Visa/Mastercard). Lucky 97 does not store full card numbers or mobile wallet credentials on its own servers.
• Any information submitted through support tickets, live chat transcripts, or email correspondence with the Lucky 97 team.

Information Generated Through Platform Use

• Login timestamps, session duration, and session frequency.
• Device type, operating system version, and browser type — collected to optimise platform performance for your device.
• IP address at the time of login and transactions.
• Betting history, game history, wagering patterns, deposit and withdrawal records, and bonus usage — all stored for account management, responsible gaming monitoring, and dispute resolution purposes.
• Clicks, navigation paths, and feature usage within the Lucky 97 platform, used for UX improvement purposes in anonymised aggregate form.

Lucky 97 uses the personal data it collects for specific, legitimate purposes. Every data point we collect corresponds to at least one of the following use cases:

• Account Creation and Management: Your name, contact details, and identity documents are used to create and maintain your Lucky 97 account, verify your identity, and ensure the account belongs to a single eligible person aged 18 or over.
• Transaction Processing: Financial data and payment method details are used to process deposits and withdrawals in PKR, to verify that payment methods are registered in your own name, and to maintain an accurate transaction record for your account.
• Fraud Prevention and Security: IP addresses, device information, login patterns, and transaction data are analysed to detect unusual activity that may indicate unauthorised access, multi-accounting, payment fraud, or money laundering. Lucky 97 has a legal obligation to perform these checks.
• Responsible Gaming Monitoring: Behavioural and financial data — such as session frequency, deposit volumes, and loss patterns — are monitored to identify signs of problem gambling activity. This enables the Lucky 97 team to reach out proactively to players who may benefit from responsible gaming tools or resources.
• Customer Support: Data from support interactions, including chat logs and email correspondence, is retained to maintain the quality and continuity of support, to train the support team, and to resolve disputes.
• Legal and Regulatory Compliance: Certain data is retained to comply with anti-money laundering (AML) obligations, respond to lawful requests from relevant authorities, and maintain records required by applicable law.
• Platform Improvement: Anonymised, aggregated usage data is used to understand how players interact with Lucky 97, which features are most used, and where the platform experience can be improved. This analysis does not involve reviewing individually identifiable data.
• Promotional Communications: If you have opted into marketing communications, your email address and betting preferences may be used to send you personalised offers, tournament announcements, and promotions from Lucky 97. You can opt out at any time via the unsubscribe link in any marketing email or by contacting support.

Lucky 97 processes your personal data only where there is a valid legal basis for doing so. The primary legal bases that apply to our data processing activities are as follows:

• Contractual Necessity: Processing your identity, contact, and financial data is necessary to fulfil the contract between you and Lucky 97 — specifically, to operate your account, process your deposits and withdrawals, and provide access to games and betting markets.
• Legal Obligation: Processing related to identity verification, AML checks, and regulatory record-keeping is required by applicable law and cannot be declined without affecting your ability to use the platform.
• Legitimate Interest: Platform security monitoring, fraud detection, responsible gaming analysis, and platform improvement activities are conducted on the basis of Lucky 97's legitimate interest in operating a safe and effective platform. These activities are conducted with appropriate safeguards and do not override your privacy rights.
• Consent: Marketing communications are sent only where you have explicitly opted in. You can withdraw this consent at any time by unsubscribing from marketing emails or contacting our support team.

Lucky 97 does not sell or rent your personal data to any third party, ever. The only circumstances under which your data is shared with outside parties are the following:

• Payment Service Providers: Easypaisa, JazzCash, NayaPay, SadaPay, and Visa/Mastercard processing networks receive the transactional data necessary to process your deposits and withdrawals. Each of these providers operates under its own privacy and security obligations. Lucky 97 does not share more data than is required to complete a transaction.
• Identity Verification Partners: Where Lucky 97 uses a third-party KYC service to verify identity documents, the minimum necessary data is shared with that provider for the sole purpose of verification. These providers are contractually prohibited from using your data for any other purpose.
• Game Software Providers: Some casino games are provided by third-party software studios. While Lucky 97 controls the account and financial layer, game providers may receive anonymised session data to operate and audit their games. No personally identifiable information is shared with game providers beyond what is strictly necessary for game operation.
• Legal Authorities: Lucky 97 will disclose personal data to law enforcement, regulatory authorities, or courts where required by law or a valid legal order. Lucky 97 will not voluntarily disclose data to authorities beyond what is legally required.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all Lucky 97's assets, user data may be transferred to the acquiring entity. Users will be notified prior to such a transfer, and the acquiring entity will be required to honour this Privacy Policy or provide users with an opportunity to delete their accounts.

Lucky 97 uses cookies and similar technologies on the lucky97.bio website and platform. Cookies are small text files stored on your device that help the platform function correctly and remember your preferences between sessions.

The cookies used by Lucky 97 fall into the following categories:

• Essential Cookies: These are required for the platform to function. They manage your login session, maintain your account state between page loads, and support core security features. You cannot opt out of essential cookies while using the platform.
• Functional Cookies: These cookies remember your preferences — such as your preferred language, display settings, and last-visited game — so you don't have to re-configure them every session. These can be disabled, though this will affect personalisation features.
• Analytics Cookies: Lucky 97 uses anonymised analytics to understand how users navigate the platform — which pages are visited most, where users spend the most time, and where drop-offs occur. This data is used in aggregate form only and does not identify individual users.
• Security Cookies: These cookies support fraud detection and session security functions. They help Lucky 97 identify unusual device behaviour or access patterns that may indicate account compromise.

Lucky 97 does not use cookies to track your activity across other websites or to build advertising profiles. There are no third-party advertising trackers embedded in the Lucky 97 platform.

You can manage cookie preferences through your browser settings. Blocking all cookies will prevent the Lucky 97 platform from functioning correctly — in particular, essential session cookies must be enabled for you to log in and place bets.

Lucky 97 takes the security of your personal data seriously. We apply the following technical and organisational measures to protect your information from unauthorised access, disclosure, alteration, or destruction:

• Encryption in Transit: All data transmitted between your device and the Lucky 97 platform is encrypted using TLS 1.2 or higher (256-bit SSL). The padlock icon visible in your browser when visiting lucky97.bio confirms this encryption is active.
• Encryption at Rest: Sensitive data stored on Lucky 97 servers — including identity documents and financial records — is encrypted at rest using industry-standard encryption algorithms.
• Access Controls: Access to personal data within Lucky 97's systems is restricted to employees and contractors who have a genuine operational need for it. All access is logged and audited.
• Payment Security: Lucky 97 does not store full payment card numbers or mobile wallet credentials on its own infrastructure. Payment processing is handled by PCI-compliant payment service providers who are responsible for the security of payment data.
• Security Monitoring: Lucky 97 maintains active security monitoring of its platform infrastructure to detect and respond to threats. Intrusion detection systems are in place and regularly reviewed.
• Staff Training: All Lucky 97 staff and contractors who handle personal data receive data security training as part of their onboarding, with regular refreshers.

Despite these measures, no internet platform can guarantee complete security against all possible threats. In the event of a data breach that is likely to result in a risk to your rights and freedoms, Lucky 97 will notify affected users without undue delay and take all reasonable steps to contain and remediate the breach.

Lucky 97 retains personal data only for as long as it is necessary for the purpose for which it was collected, or as required by applicable law. The following retention periods apply to the main categories of data we hold:

• Account and Identity Data: Retained for the duration of your account's active status plus a minimum of five years following account closure. This period reflects legal obligations related to AML record-keeping.
• Transaction Records: Retained for a minimum of five years following each transaction, in accordance with standard financial record-keeping requirements.
• Game and Betting History: Retained for three years from the date of each activity for dispute resolution and responsible gaming monitoring purposes.
• Support Communications: Retained for two years from the date of the last interaction in a support thread, unless the communication relates to an unresolved dispute, in which case records are retained until the dispute is resolved.
• Marketing Consent Records: Retained for five years from the date consent was given or withdrawn, as required for compliance demonstration purposes.
• Technical Logs (IP addresses, device data): Retained for 12 months from the date of collection, unless retained longer in connection with a security investigation or legal proceeding.

When data is no longer required and its retention period has expired, Lucky 97 securely deletes or anonymises it so that it can no longer be associated with an individual account.

As a Lucky 97 user, you have the following rights over your personal data. These are genuine rights that Lucky 97 is committed to honouring, not just items on a legal checklist.

To exercise any of the above rights, contact Lucky 97 at support@lucky97.bio with the subject line "Data Rights Request". We will acknowledge your request within 48 hours and fulfil it within 30 days. We may ask for verification of your identity before processing a data rights request to ensure we are dealing with the account holder.

Lucky 97 operates a strict 18+ policy. The platform does not knowingly collect personal data from any person under the age of 18. Registration requires date of birth confirmation, and Lucky 97 conducts age verification checks on all accounts.

If Lucky 97 discovers that an account is being operated by a person under the age of 18, the account will be closed immediately, all activity will be reversed where possible, and any data collected will be deleted in accordance with applicable law. No winnings generated during under-age activity will be paid out.

If you are a parent or guardian and believe that a person under 18 in your household has registered a Lucky 97 account, please contact support@lucky97.bio immediately. We will investigate and take action without delay.

Lucky 97 may update this Privacy Policy from time to time to reflect changes in our data practices, the services we offer, or applicable legal requirements. When material changes are made, Lucky 97 will notify registered users via email and post a notice on the platform at least 14 days before the changes take effect.

The effective date at the top of this page shows when this version of the policy was last updated. If you continue to use Lucky 97 after updated terms are posted, you are confirming your acceptance of the updated policy. If you do not agree with any changes, please contact support to request account closure.

For any questions, concerns, or requests related to this Privacy Policy or Lucky 97's data practices, please get in touch through any of the following channels:

• Email: support@lucky97.bio — use the subject line "Privacy Query" for faster routing.
• Live Chat: Available 24/7 on lucky97.bio — ask to be connected to the data privacy team if your query relates specifically to data rights.
• Response Time: Privacy queries are treated with priority. You can expect an acknowledgement within 24 hours and a substantive response within five business days.