lucky33 Privacy Policy for Malaysian Users

Definitions and Data Controller

In this policy, “personal data” means information that identifies you or can reasonably be connected with you. “Processing” includes collecting, recording, organising, storing, reviewing, sharing, correcting and deleting personal data. “Services” means the lucky33 website, account tools, casino content, sports markets, promotions, payments and support functions.

For the purposes described in this policy, lucky33 determines why and how account information is processed, except where an independent payment provider or other service provider acts under its own legal responsibilities. Questions about this policy can be submitted using the contact details stated below.

Personal Data We Collect

lucky33 may collect information supplied directly by you, generated through your use of the services or received from authorised providers. Relevant categories may include:

• Identity details such as your legal name, date of birth, nationality and age confirmation.
• Contact details such as residential address, email address and phone number.
• Account information, security settings, communication preferences and support history.
• KYC records, including identity documents, proof of address, a verification selfie and review results.
• Payment details, deposit and withdrawal records, MYR transaction values and payment ownership evidence.
• Gaming information, including wagers, results, bonuses, limits, session activity and account restrictions.
• Technical information such as IP address, browser type, device identifiers, operating system and security logs.

You should provide accurate information and update lucky33 when important account details change. Do not submit another person's documents or payment information without lawful authority.

How Personal Data Is Collected

Information is collected when you register with lucky33, update your profile, verify your identity, deposit or withdraw funds, use casino or sports features, activate a limit or contact support. Technical data may be recorded automatically when your device communicates with the website.

lucky33 may also receive information from payment processors, identity verification suppliers, fraud prevention providers and other authorised operational partners. For example, an FPX or DuitNow transaction may generate confirmation data, reference numbers and status information without disclosing full bank credentials to lucky33.

Where legally permitted, public records or security databases may be consulted to confirm identity, detect sanctions exposure, investigate fraud or protect the integrity of lucky33 services. Information from those sources is reviewed in context and is not automatically treated as proof of wrongdoing.

Purposes of Data Processing

lucky33 processes personal data where necessary to provide services, perform the user agreement, satisfy applicable obligations, protect legitimate interests or act on valid consent. Common purposes include:

• Creating, authenticating and maintaining your lucky33 account.
• Confirming that users meet the minimum age requirement of 21 years.
• Completing KYC, anti-fraud, payment ownership and account security checks.
• Processing deposits, withdrawals, refunds, bonuses and account adjustments.
• Settling casino and sports activity and maintaining accurate transaction records.
• Providing support, handling complaints and investigating technical issues.
• Enforcing deposit limits, cooling-off periods and self-exclusion requests.
• Detecting duplicate accounts, prohibited conduct, chargeback abuse and security threats.
• Improving site reliability, navigation and content for Malaysian users.

lucky33 will not use identity documents for an unrelated purpose merely because they are available. A new incompatible purpose will require an appropriate legal basis and, where necessary, a further notice.

KYC and Sensitive Verification Records

Identity verification helps lucky33 confirm age, establish account ownership, protect withdrawals and reduce fraud. Documents may include a valid identity card, driver's licence or passport, proof of address issued within the previous three months, and a selfie used to compare the applicant with the submitted document.

Verification records are restricted to authorised functions and approved service providers with a genuine need to process them. lucky33 may retain evidence of completed checks for security, dispute resolution and compliance purposes, even after an account closes, where retention is reasonably required.

Upload documents only through a trusted lucky33 page using HTTPS. Never place identification documents in public messages or send them through unsecured chats. Where a document field is not required and masking is permitted, users may cover unnecessary sensitive digits before upload.

Payments and Financial Information

Payment data may include the account holder's name, bank or e-wallet type, partial account identifiers, transaction reference, payment status, amount, currency and timing. lucky33 generally does not need a user's complete online banking password, card PIN or one-time bank security code. Users must never disclose those credentials to support staff.

When a Malaysian user selects Maybank, CIMB, Public Bank, Hong Leong, FPX, DuitNow, Touch 'n Go eWallet, Boost or another supported method, payment information may be exchanged with the relevant provider to process and verify the transaction. Those parties may conduct independent fraud and compliance checks.

lucky33 may compare payment ownership information against verified account details. A mismatch can result in additional review, a delayed withdrawal or a request to use a payment method held in the user's own name.

Cookies and Device Technologies

lucky33 may use cookies and similar technologies to maintain sessions, remember preferences, protect sign-ins, measure performance and understand how pages are used. Essential cookies support core functions and may be necessary for the requested service.

Analytics information can help lucky33 identify slow pages, navigation problems and device compatibility issues affecting users in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, Shah Alam and elsewhere. Reports should be reviewed in aggregated or appropriately protected form where practical.

You may adjust browser settings to block or delete cookies. Some lucky33 functions may not operate correctly if essential storage is disabled. Cookie choices do not prevent necessary server security logs from being generated.

Sharing and Service Providers

lucky33 may disclose limited personal data to vetted providers that support hosting, cybersecurity, identity verification, payment processing, customer service, game delivery, sports data, fraud prevention and responsible gambling controls. Providers must process information according to applicable contractual and security requirements.

Personal data may also be disclosed where reasonably necessary to establish, exercise or defend legal claims; investigate suspected fraud; respond to a lawful authority; protect a user or another person; or enforce lucky33 terms. Information is not disclosed merely because an informal third-party request has been received.

If business ownership or operational structure changes, relevant data may be transferred as part of a legitimate reorganisation, acquisition or asset transfer. Appropriate confidentiality and data protection safeguards will continue to apply.

International Data Transfers

Some lucky33 suppliers may operate outside Malaysia. Where personal data is processed internationally, lucky33 will seek appropriate safeguards consistent with the sensitivity of the data, the receiving location and applicable requirements.

Safeguards may include contractual restrictions, controlled access, encryption, supplier assessments and limits on further disclosure. An international transfer does not remove the privacy and security responsibilities described in this policy.

Data Security

lucky33 uses proportionate technical and organisational measures designed to protect personal data. Measures may include encrypted transmission, access controls, activity logging, account authentication, network monitoring, staff confidentiality requirements and incident response procedures.

No internet service can promise absolute security. Users can reduce risk by choosing a unique password, keeping verification codes private, signing out on shared devices and checking the lucky33 domain before entering information. Suspected unauthorised access should be reported promptly.

If a personal data incident creates a material risk, lucky33 will investigate, contain the issue and provide notices where required. Details may be shared with affected users or relevant authorities when legally appropriate.

Retention and Account Closure

lucky33 retains personal data only for as long as reasonably necessary for the original purpose and any legitimate legal, security, tax, payment, fraud prevention or dispute-resolution need. Different categories may have different retention periods.

Closing a lucky33 account does not always permit immediate deletion. Transaction records, KYC evidence, self-exclusion information and security logs may need to remain available to resolve claims, prevent a restricted account from reopening or comply with applicable obligations.

When retention is no longer justified, information will be deleted, anonymised or placed beyond ordinary operational use. Anonymised statistical data that no longer identifies a person may be retained for service analysis.

User Rights

Subject to identity verification and applicable limitations, you may ask lucky33 to provide access to personal data, correct inaccurate details, explain processing, restrict certain uses, delete eligible information or review an objection. You may also withdraw consent where processing depends specifically on consent.

A request should identify the relevant account and clearly describe the information or action concerned. lucky33 may request proof of identity before releasing data or changing an account. This protects users from fraudulent privacy requests.

Some requests may be limited where disclosure would affect another person's rights, reveal protected security information, interfere with fraud prevention or conflict with a valid retention duty. Where a request cannot be completed, lucky33 will provide an explanation when permitted.

Responsible Gambling Data

lucky33 may process gambling behaviour, deposit patterns, session duration, limit settings, support contacts and self-exclusion status to operate responsible gambling controls and identify potential indicators of harm. This processing supports player safety and the enforcement of account restrictions.

Self-exclusion information may be retained after closure so lucky33 can recognise and prevent attempts to reopen a restricted account. Users must not create another account to avoid a limit or exclusion. Responsible gambling records are handled with appropriate confidentiality and access controls.

Policy Updates and Contact Us

lucky33 may revise this Privacy Policy to reflect legal, security, technical or operational developments. Material changes will be communicated through an appropriate website or account notice. The effective date at the top of this page indicates when the current version applies.

Privacy enquiries or eligible data requests may be directed to [email protected]. This email address is displayed as plain text and is not a clickable link. Include enough information to identify the matter, but never send your password, payment PIN or one-time security code.

lucky33 may need to verify your identity before discussing account-specific data. This policy is issued in English, and the English version governs its interpretation.