luckypiso Privacy Policy

1.1 This Privacy Policy ("Policy") describes how luckypiso ("the Company," "we," "us," or "our") collects, uses, stores, discloses, and protects the personal information of users ("you," "Player," or "Data Subject") of the luckypiso online gaming platform accessible at luckypiso.org.

1.2 This Policy is issued in accordance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 ("PDPA"), its Implementing Rules and Regulations, and the applicable issuances of the National Privacy Commission ("NPC") of the Philippines. It also reflects the data handling obligations applicable to PAGCOR-licensed online gaming operators.

1.3 By registering for a luckypiso Account or by continuing to use the luckypiso platform, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal information as described herein. If you do not consent, you must discontinue use of luckypiso.

1.4 This Policy applies to all personal information collected through the luckypiso website, mobile browser experience, customer support channels, and any other touchpoints through which you interact with luckypiso.

2.1 Identity of the Personal Information Controller. For the purposes of the Philippine Data Privacy Act of 2012, luckypiso is the Personal Information Controller (PIC) with respect to the personal data of all registered Players on the luckypiso platform.

2.2 As Personal Information Controller, luckypiso determines the purposes and means by which your personal data is processed and is responsible for implementing appropriate organizational, physical, and technical security measures to protect such data.

3.1 luckypiso collects personal information that is necessary, adequate, and not excessive in relation to the purposes for which it is collected. The categories of personal information we collect are described in the table below.

3.2 Sensitive Personal Information. Certain information collected during the KYC process — including Philippine government ID numbers, biometric data embedded in official IDs, and financial account details — may constitute sensitive personal information under the PDPA. luckypiso treats all such information with heightened security measures commensurate with its sensitivity.

4.1 Directly from You. The majority of personal information luckypiso holds about you is provided directly by you during:

• Account registration and profile completion;
• KYC identity verification submissions;
• Deposit and withdrawal transactions;
• Customer support and live chat interactions;
• Completion of responsible gaming limit requests or self-exclusion forms;
• Participation in promotions or surveys.

4.2 Automatically. Certain technical and usage data is collected automatically when you access the luckypiso platform, including through cookies, session logs, and analytics tools operated by or on behalf of luckypiso. See Section 7 for full details on cookies and tracking technologies.

4.3 From Third Parties. luckypiso may receive personal information from third-party identity verification providers engaged to assist with KYC compliance, from payment processing partners, and from fraud prevention services. All such third parties are contractually bound to handle data in compliance with the PDPA.

5.1 luckypiso processes your personal information only for specific, explicitly stated, and legitimate purposes. We do not use your data in ways that are incompatible with the purpose for which it was collected without obtaining fresh consent where required. The primary purposes of processing are:

• Account Management: Creating, maintaining, and securing your luckypiso Account, including authentication and access control;
• Transaction Processing: Processing deposits, withdrawals, and gaming transactions denominated in Philippine Peso via GCash, Maya, BPI, BDO, Metrobank, and other approved payment channels;
• Regulatory Compliance: Meeting KYC, AML (Anti-Money Laundering), PAGCOR reporting, and other legal obligations applicable to Philippine online gaming operators;
• Responsible Gaming: Monitoring gaming activity to identify potentially harmful patterns, enforcing account-level responsible gaming tools, and complying with PAGCOR's responsible gaming requirements;
• Customer Support: Responding to inquiries, resolving complaints, and providing technical assistance via live chat, email, or other support channels;
• Platform Security & Fraud Prevention: Detecting, investigating, and preventing unauthorized access, fraud, money laundering, and other prohibited conduct;
• Platform Improvement: Analyzing anonymized or aggregated usage data to improve the luckypiso platform, game offerings, and user experience;
• Marketing Communications: Sending promotional offers, bonus notifications, and news about luckypiso products and services, subject to your marketing communication preferences (see Section 14).

6.1 Under the Philippine Data Privacy Act of 2012, luckypiso relies on the following lawful bases for the processing of your personal information:

• Contractual Necessity: Processing required to fulfill our obligations under the luckypiso Terms & Conditions — including account management, payment processing, and game result recording — is processed on the basis that it is necessary for the performance of a contract to which you are a party.
• Legal Obligation: Processing required to comply with applicable Philippine laws, including PAGCOR regulations, the Anti-Money Laundering Act, the Cybercrime Prevention Act, and the Data Privacy Act itself, is processed on the basis of legal obligation.
• Legitimate Interests: Processing for fraud prevention, platform security, and responsible gaming monitoring is conducted on the basis of the legitimate interests of luckypiso and the broader player community, where such interests are not overridden by your rights and freedoms.
• Consent: Processing for marketing communications and optional analytics is conducted on the basis of your freely given, specific, and informed consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

7.1 luckypiso uses cookies and similar tracking technologies (including local storage and session identifiers) to operate and improve the platform. Cookies are small text files placed on your device by the luckypiso website.

7.2 Types of Cookies Used:

7.3 Cookie Control. You may control and delete cookies through your browser settings at any time. Disabling strictly necessary cookies will affect platform functionality, including your ability to stay logged into your luckypiso Account. Disabling analytics or marketing cookies does not affect your ability to access any luckypiso service.

8.1 luckypiso does not sell, rent, or trade your personal information to any third party for their own independent marketing or commercial purposes. We share personal data only where necessary and only with the following categories of recipients:

• Payment Processors: GCash (GXI), Maya (Voyager Innovations), BPI, BDO, Metrobank, GrabPay, InstaPay network participants, and 7-Eleven CLiQQ, solely for the purpose of processing deposits and withdrawals;
• Identity Verification Providers: Third-party KYC and AML compliance vendors engaged to assist with identity verification, document authentication, and politically exposed person screening;
• Game Software Providers: Licensed game providers (including Evolution Gaming, Pragmatic Play, PG Soft, and JILI Games) receive the minimum session and wager data necessary to deliver and record their games;
• Regulatory Authorities: PAGCOR, the Anti-Money Laundering Council (AMLC), the National Privacy Commission (NPC), and other Philippine regulatory bodies as required by law;
• Law Enforcement: Philippine government agencies, courts, and law enforcement bodies where disclosure is required by a valid court order, subpoena, or applicable law;
• IT & Security Service Providers: Cloud infrastructure, cybersecurity, and platform monitoring service providers operating under strict data processing agreements that prohibit independent use of your data.

9.1 luckypiso retains your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law and regulatory obligations.

9.2 Specific retention periods applicable to luckypiso data categories are as follows:

• Active Account Data: Retained for the duration of the Account plus the applicable post-closure retention period below;
• KYC and Identity Documents: Retained for a minimum of five (5) years from the date of account closure, as required under PAGCOR regulations and the Anti-Money Laundering Act;
• Financial Transaction Records: Retained for a minimum of five (5) years from the date of each transaction, in compliance with BIR and AMLC requirements;
• Game History Logs: Retained for a minimum of three (3) years for dispute resolution and PAGCOR audit purposes;
• Marketing Preferences: Retained until you withdraw consent or request deletion, subject to legal minimum retention requirements;
• Support Communications: Retained for a minimum of two (2) years for quality assurance and dispute resolution.

9.3 Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with NPC-approved data disposal procedures.

10.1 luckypiso implements appropriate organizational, physical, and technical security measures designed to protect your personal information against unauthorized access, accidental loss, alteration, disclosure, or destruction.

10.2 Technical Measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and the luckypiso platform;
• Encryption at rest for sensitive personal information stored on luckypiso servers;
• Multi-factor authentication available for all Player Accounts;
• Continuous intrusion detection and threat monitoring systems;
• Regular penetration testing and vulnerability assessments by independent security firms.

10.3 Data Breach Response. In the event of a personal data breach that poses a real risk of serious harm to data subjects, luckypiso will notify the National Privacy Commission (NPC) within seventy-two (72) hours of becoming aware of the breach, as required under the PDPA. Affected Players will be notified without undue delay where the breach is likely to result in high risk to their rights and freedoms.

11.1 Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal information held by luckypiso. These rights are subject to applicable legal limitations and regulatory retention requirements:

11.2 Exercising Your Rights. To exercise any of the rights above, submit a written request to the luckypiso Data Privacy Officer at [email protected]. Requests will be acknowledged within three (3) business days and substantively addressed within fifteen (15) business days, extendable by a further fifteen (15) days where processing is complex.

11.3 Identity Verification for Rights Requests. To protect your data and prevent unauthorized access, luckypiso may require identity verification before fulfilling a data rights request. This verification will be conducted using your registered KYC information.

12.1 luckypiso does not knowingly collect, process, or store personal information from individuals under the age of 21. If you believe that luckypiso has inadvertently collected data from a minor, please contact our Data Privacy Officer at [email protected] immediately.

12.2 Parents and guardians are encouraged to monitor the gaming activity of individuals in their household and to ensure that minors do not access the luckypiso platform or any device on which a luckypiso Account session is active.

13.1 Some of luckypiso's third-party service providers — particularly game software providers and cloud infrastructure partners — may process or store data on servers located outside the Republic of the Philippines. Where cross-border transfers occur, luckypiso ensures that appropriate safeguards are in place, including:

• Data processing agreements with contractual clauses providing data protection equivalent to PDPA standards;
• Transfer only to jurisdictions recognized by the NPC as providing adequate protection, or where specific NPC approval has been obtained;
• Minimization of the data shared with cross-border processors to only what is strictly necessary for the service function.

13.2 luckypiso will notify the NPC prior to undertaking any cross-border transfer that does not fall within an approved exemption, as required under NPC Circular 16-01.

14.1 With your consent, luckypiso may send you marketing communications about promotions, bonuses, new games, and luckypiso platform features via SMS to your registered Philippine mobile number and via email to your registered email address.

14.2 Opt-Out. You may withdraw consent for marketing communications at any time by:

• Updating your communication preferences in Account Settings under "Notifications";
• Clicking the "Unsubscribe" link included in any marketing email;
• Contacting luckypiso customer support and requesting removal from marketing communications.

14.3 Withdrawing consent for marketing communications does not affect your ability to use your luckypiso Account. Transactional communications — including deposit confirmations, withdrawal notifications, security alerts, and account-required notices — will continue to be sent regardless of your marketing preferences, as these are necessary for the operation of your Account.

15.1 luckypiso reserves the right to update or revise this Privacy Policy at any time to reflect changes in our data practices, applicable law, or PAGCOR regulatory requirements. The revised Policy will be published on the luckypiso website with an updated effective date.

15.2 Where changes are material — particularly where they affect how we use your personal information or your rights as a data subject — luckypiso will provide advance notice via email or in-account notification prior to the changes taking effect. The notice period will be at least seven (7) days for material changes.

15.3 Your continued use of the luckypiso platform after the effective date of an updated Privacy Policy constitutes your acknowledgment of the revised Policy. If you object to any material change, you may request account closure as described in the luckypiso Terms & Conditions.

16.1 luckypiso has designated a Data Privacy Officer (DPO) responsible for ensuring compliance with the Philippine Data Privacy Act of 2012 and overseeing data protection practices across the organization.

16.2 For any questions, concerns, or requests relating to this Privacy Policy or your personal data rights, please contact:

16.3 National Privacy Commission. If you are dissatisfied with luckypiso's response to a data rights request or believe your rights under the PDPA have been violated, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines. Details of the NPC's complaint process are available on the NPC's official government website.