luckyyi Privacy Policy
Your Data, Clearly Explained

For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, the data controller responsible for personal data processed in connection with the luckyyi platform is luckyyi, the operator of the online gaming platform accessible at luckyyi.net ("luckyyi," "we," "us," or "our").

luckyyi has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and with the Data Privacy Act. You may contact the DPO directly at the email address provided in Section 16 of this Policy. The DPO is your primary point of contact for all data subject rights requests, privacy concerns, and breach notifications.

This Privacy Policy applies to all personal data collected, processed, or stored by luckyyi in connection with:

• Registration and maintenance of a luckyyi player account;
• Use of any game, betting market, or interactive feature on luckyyi.net;
• Deposit, withdrawal, and other financial transactions conducted through the Platform;
• Customer support and live chat interactions;
• Participation in any promotional, loyalty, or bonus programme operated by luckyyi;
• Completion of any Know Your Customer (KYC) or identity verification process;
• Subscription to any marketing communications from luckyyi; and
• Any other interaction between you and luckyyi through the Platform or its official communication channels.

This Policy does not apply to third-party websites, services, or platforms that may be referenced on luckyyi.net or accessible through the Platform. Third-party services operate under their own privacy policies, which are independent of and unrelated to this document.

The following table summarizes the categories of personal data luckyyi collects and the primary purpose for which each category is collected:

3.1 Special Categories of Personal Data

luckyyi does not seek to collect or process sensitive personal information as defined under Section 3(l) of the Data Privacy Act — including racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation — except where such information is voluntarily disclosed by the player in the context of a responsible gaming, self-exclusion, or wellbeing request. Such information is processed solely for the purpose for which it was disclosed and is not used for any other processing activity.

luckyyi collects personal data through the following means:

4.1 Direct Collection

Data you provide directly to luckyyi during: account registration; KYC document submission; deposit and withdrawal requests; live chat and email support interactions; promotional participation; completion of any surveys or feedback forms; and self-exclusion or responsible gaming requests.

4.2 Automated Collection

Data collected automatically when you access or use the Platform, including through cookies and similar tracking technologies (see Section 12), server logs, device identifiers, and session tracking systems. This automated collection occurs each time you interact with any page or feature of the luckyyi Platform.

4.3 Third-Party Sources

luckyyi may receive personal data about you from third-party sources in limited circumstances, including: identity verification service providers used during KYC processing; payment processors confirming transaction status; fraud prevention and AML screening services; and game providers' own session and dispute records where applicable to a luckyyi dispute resolution process.

luckyyi uses your personal data for the following purposes:

• Account Registration and Management: Creating, verifying, operating, and maintaining your luckyyi account, including processing deposits, withdrawals, and gaming activity.
• Identity Verification and KYC: Confirming your identity, age (21+), and eligibility to use the Platform in compliance with PAGCOR requirements and the Anti-Money Laundering Act.
• Payment Processing: Facilitating GCash, PayMaya, and bank transfer transactions; verifying payment method ownership; processing refunds and chargebacks where applicable.
• Gaming and Platform Operation: Delivering game content, resolving gaming disputes, calculating and crediting winnings, applying bonus terms, and maintaining the technical integrity of the Platform.
• Security and Fraud Prevention: Detecting, investigating, and preventing unauthorized access, fraudulent account creation, bonus abuse, money laundering, and other prohibited conduct.
• Regulatory Compliance: Fulfilling mandatory reporting obligations to PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine regulatory bodies.
• Responsible Gaming: Monitoring gaming activity for indicators of problem gambling; enforcing player-set deposit and session limits; processing self-exclusion requests; and complying with PAGCOR responsible gaming standards.
• Customer Support: Responding to support inquiries, resolving account and transaction issues, conducting quality assurance reviews of support interactions.
• Marketing Communications: Sending promotional offers, bonus notifications, and platform updates to players who have provided consent to receive marketing communications (see Section 13).
• Platform Improvement: Analysing aggregated, anonymised usage data to improve Platform performance, user experience, and game selection — this analysis does not identify individual players.

Under the Philippine Data Privacy Act, luckyyi processes personal data only where a recognized lawful basis exists. The lawful bases applicable to luckyyi's processing activities are as follows:

• Contractual Necessity: Processing necessary to perform our contract with you — the luckyyi Terms and Conditions — including account operation, payment processing, game delivery, and dispute resolution.
• Legal Obligation: Processing required to comply with Philippine law, including but not limited to PAGCOR regulatory requirements, the Anti-Money Laundering Act, the Data Privacy Act, the Tax Code, and applicable court orders.
• Legitimate Interests: Processing for fraud prevention, security monitoring, and platform improvement where such processing does not override your fundamental data privacy rights.
• Consent: Processing for marketing communications and non-essential cookies, where your prior, freely given, specific, informed, and unambiguous consent has been obtained. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

luckyyi does not sell, rent, or trade personal data to third parties. We share personal data only in the following circumstances and with the following categories of recipient:

7.1 Service Providers and Processors

luckyyi engages third-party service providers who process personal data on our behalf as personal information processors under written data processing agreements. These include: identity verification and KYC service providers; payment processors and e-wallet operators (GCash/GXI, PayMaya/Voyager Innovations, BancNet); cloud infrastructure and hosting providers; customer support platform providers; game software providers (Evolution Gaming, Pragmatic Play, PG Soft, JILI, and others); and fraud detection and AML screening service providers. All processors are bound by contractual obligations to process data only on luckyyi's documented instructions and to maintain appropriate security standards.

7.2 Regulatory and Law Enforcement Authorities

luckyyi is legally obligated to disclose personal data to regulatory bodies and law enforcement authorities in response to lawful requests, including: the Philippine Amusement and Gaming Corporation (PAGCOR); the Anti-Money Laundering Council (AMLC); the National Privacy Commission (NPC); the Bureau of Internal Revenue (BIR); and any Philippine court of competent jurisdiction. Such disclosures are limited to the minimum data required to satisfy the lawful request and are logged in our compliance records.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of the assets of luckyyi, personal data held by us may be transferred to the acquiring entity as part of such transaction. You will be notified of any such transfer via your registered email address no less than thirty (30) days before the transfer takes effect, and the acquiring entity will be required to honor the commitments made in this Privacy Policy.

The luckyyi Platform is primarily operated and data is primarily stored within Philippine jurisdiction. However, some third-party service providers used by luckyyi (including certain game software providers and cloud infrastructure partners) may process personal data in data centers located outside the Philippines.

Where personal data is transferred outside the Philippines, luckyyi ensures that such transfers are protected by appropriate safeguards, including: standard contractual clauses approved by the National Privacy Commission; transfer only to countries or organizations that maintain an adequate level of data protection as recognized under Philippine law; or explicit consent from the data subject where required.

You may request details of any specific international data transfer arrangements applicable to your data by contacting the Data Protection Officer at the address in Section 16.

luckyyi retains personal data for no longer than is necessary for the purpose for which it was collected, or as required by applicable Philippine law. The following retention periods apply to the principal categories of personal data held by luckyyi:

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with NPC-approved data disposal procedures.

luckyyi implements a comprehensive set of technical and organizational security measures designed to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include but are not limited to:

• Encryption in Transit: All data transmitted between your device and luckyyi servers is encrypted using TLS 1.2 or higher (effectively 256-bit SSL encryption). No personal or financial data is transmitted over unencrypted channels.
• Encryption at Rest: Sensitive stored data, including payment details, government ID numbers, and password hashes, is encrypted at rest using AES-256 or equivalent standards.
• Access Controls: Access to personal data within luckyyi is restricted on a strict need-to-know basis. All internal system access is logged, audited, and subject to role-based access controls. Privileged access requires multi-factor authentication.
• Two-Factor Authentication (2FA): Player accounts are protected by SMS OTP-based two-factor authentication on new device logins, reducing the risk of unauthorized account access even where credentials are compromised.
• Penetration Testing: The luckyyi Platform undergoes regular penetration testing and vulnerability assessments by independent security specialists to identify and remediate potential security weaknesses before they can be exploited.
• Data Breach Response: luckyyi maintains a documented personal data breach response plan. In the event of a breach likely to result in risk to data subjects, we will notify the NPC within seventy-two (72) hours of discovery, and affected players will be notified without undue delay.
• Staff Training: All luckyyi employees and contractors with access to personal data receive mandatory data privacy and security training upon onboarding and annually thereafter.

Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to personal data that luckyyi holds about you. These rights can be exercised at any time by contacting the luckyyi Data Protection Officer (see Section 16):

luckyyi will respond to all verified data subject rights requests within thirty (30) days of receipt. Requests that are complex or numerous may be extended by a further sixty (60) days, with written notification of the extension provided within the initial thirty-day period. Requests are fulfilled at no cost to the data subject unless the request is manifestly unfounded or excessive, in which case a reasonable fee may apply.

luckyyi uses cookies and similar tracking technologies on the Platform. Cookies are small text files placed on your device by the Platform to support functionality, security, and analytics. The following categories of cookies are used by luckyyi:

• Strictly Necessary Cookies: Essential for the Platform to function — including session authentication tokens, security cookies, and load balancing cookies. These cannot be disabled without materially impairing Platform functionality. They do not require consent.
• Functional Cookies: Remember your preferences, such as language settings, last-visited game category, and live chat state. These are set to improve your experience and do not track cross-site activity.
• Analytics Cookies: Collect aggregated, anonymised data about how players use the Platform — including which pages are visited most frequently and where errors occur. This data is used to improve Platform performance. Analytics cookies require consent.
• Marketing Cookies: Only set with your explicit consent and used to deliver promotional messages relevant to your gaming preferences. Marketing cookies are not used to track activity on third-party websites.

You may manage your cookie preferences through the cookie consent mechanism displayed on your first visit to luckyyi.net. You may also configure your browser to block or delete cookies; however, disabling strictly necessary cookies will impair your ability to use the Platform.

luckyyi may send you promotional communications about bonuses, new games, events, and platform features by SMS to your registered Philippine mobile number, by email to your registered email address, and through in-platform notifications. All marketing communications from luckyyi require your explicit prior consent, which is collected during account registration and may be updated at any time through your Account Settings.

You may opt out of any or all marketing communications at any time by: updating your preferences in Account Settings; clicking the unsubscribe link included in any promotional email; or contacting luckyyi support via live chat or email and requesting removal from marketing communications. Opt-out requests are processed within five (5) Philippine business days.

The luckyyi Platform is intended exclusively for adults who are at least twenty-one (21) years of age, as required by PAGCOR for all casino-style gaming activities in the Philippines. luckyyi does not knowingly collect personal data from individuals under the age of 21.

Age verification is a mandatory component of the luckyyi KYC process. All accounts are subject to age verification before withdrawal privileges are activated. Where luckyyi has reason to believe that a registered account belongs to a person under 21, the account is immediately suspended pending investigation. If the investigation confirms underage registration, all personal data collected in connection with that account will be securely deleted (subject only to any retention obligations required by PAGCOR or applicable law to evidence the underage account incident), and the matter will be reported to PAGCOR as required.

If you have reason to believe that a person under 21 has registered a luckyyi account, please contact luckyyi support or the Data Protection Officer immediately.

luckyyi reserves the right to update, revise, or replace this Privacy Policy at any time. Where revisions are material — for example, changes to the categories of data collected, new third-party sharing arrangements, or changes to data subject rights procedures — luckyyi will provide advance notice via email to your registered address and/or a prominent notice on the Platform, no less than thirty (30) days before the revised Policy takes effect.

Non-material updates (such as typographical corrections, clarifications of existing practices, or updates to contact details) may be implemented without prior notice. The "Last Reviewed" date at the top of this document indicates when the most recent revision was made. Your continued use of the luckyyi Platform after the effective date of any updated Policy constitutes your acceptance of the revised terms.

We encourage you to review this Policy periodically. If you have any questions about a change, please contact the Data Protection Officer at the address in Section 16 before the change takes effect.

For all matters relating to this Privacy Policy, including data subject rights requests, privacy complaints, consent withdrawals, and general privacy inquiries, please contact the luckyyi Data Protection Officer through the following channels:

• Email: [email protected] — mark your email "Data Privacy Request" or "DPO Inquiry" to ensure it is routed directly to the Data Protection Officer.
• Live Chat: Available 24/7 in English and Filipino on the Platform. For data subject rights requests via live chat, you will be required to verify your identity before the request is processed.

luckyyi acknowledges all data subject rights requests within five (5) Philippine business days and aims to fulfill verified requests within thirty (30) calendar days. Where additional time is required, you will be notified in writing with an explanation and a revised timeline.

If you are not satisfied with luckyyi's handling of your privacy concern, you have the right to lodge a complaint with the National Privacy Commission of the Philippines (NPC) through its official complaint channels. Information about the NPC's complaint process is publicly available through the NPC's official website.