luckyi8 Privacy Policy

Introduction & Scope

Welcome to luckyi8. This Privacy Policy ("Policy") describes how luckyi8 ("luckyi8", "we", "us", or "our") collects, uses, stores, shares, and protects the personal information of individuals ("Player", "you", or "your") who access or use the luckyi8 online casino and sports betting platform available at luckyi8.pro, including all associated mobile interfaces and support channels.

This Policy applies to all luckyi8 Players regardless of the device or method used to access the Platform. It covers every category of personal data processed by luckyi8 in connection with account registration, identity verification, deposits, withdrawals, gameplay, customer support, and marketing communications.

By registering an account on luckyi8 or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read, understood, and agreed to the practices described herein. If you do not agree with any part of this Policy, you should discontinue use of the Platform and request account closure via [email protected].

Data Controller

For the purposes of applicable data protection law, luckyi8 is the data controller in respect of all personal data collected from Players through the Platform. This means luckyi8 determines the purposes and means by which your personal data is processed.

luckyi8 operates under an international gaming licence and maintains its data processing infrastructure in accordance with internationally recognised data protection standards. While luckyi8 primarily serves players located in Pakistan, its data processing obligations are governed by the terms of its operating licence and applicable international data protection frameworks.

Data We Collect

luckyi8 collects only the personal data necessary for the purposes described in this Policy. We do not collect data speculatively or in excess of what is required for the operation of a regulated online gaming platform. The categories of personal data we collect are set out in the table below.

luckyi8 does not collect sensitive personal data beyond what is strictly necessary for identity verification and responsible gaming compliance. Specifically, luckyi8 does not collect racial or ethnic origin data, religious beliefs, health data beyond problem gambling indicators, or biometric data beyond the CNIC document scan used for age and identity verification.

How We Collect Your Data

luckyi8 collects personal data through the following primary channels:

• Direct submission: Data you provide during registration, KYC verification, deposit/withdrawal requests, support interactions, and when updating your account profile.
• Automated collection: Technical data collected automatically when you access the Platform, including IP address, device identifiers, session logs, and gameplay behaviour through server-side logging systems.
• Payment providers: Transaction confirmation data shared by JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, and 1LINK when you initiate deposits or withdrawals. luckyi8 does not store full payment account credentials — only the minimum reference data necessary to process and reconcile transactions.
• Identity verification partners: Confirmation data from third-party KYC verification services used to validate CNIC authenticity. These partners operate under strict data processing agreements with luckyi8.
• Cookies and tracking technologies: Session data and preference information collected via cookies when you use the Platform. Full details are provided in Section 10.

Why We Use Your Data

luckyi8 uses your personal data for the following specific purposes. Each purpose is linked to a defined legal basis described in Section 6.

• Account creation and management: To register your luckyi8 account, maintain your profile, authenticate your login sessions, and manage your account settings including responsible gaming tools.
• Identity and age verification (KYC): To verify that you are at least 21 years of age and to confirm your identity via CNIC document review. This is a mandatory regulatory requirement that cannot be waived.
• Payment processing: To process PKR deposits via JazzCash, EasyPaisa, and Pakistani bank transfers, and to execute withdrawal requests to your verified payment methods.
• Fraud prevention and security: To detect and prevent fraudulent transactions, money laundering, bonus abuse, multi-accounting, and other prohibited activities. luckyi8 uses automated risk scoring systems for this purpose.
• Gaming operations: To operate games, settle bets, calculate payouts, apply bonus credits, and maintain accurate gaming records for audit purposes.
• Responsible gaming compliance: To monitor gambling behaviour for indicators of problem gambling, enforce deposit limits and self-exclusion restrictions, and fulfil our duty of care obligations.
• Customer support: To respond to enquiries, resolve complaints, and maintain records of support interactions for quality assurance purposes.
• Legal and regulatory compliance: To comply with anti-money laundering obligations, respond to law enforcement requests, and fulfil record-keeping requirements under our gaming licence.
• Marketing communications: To send promotional offers, bonus notifications, and product updates to players who have opted in to receive marketing. You may withdraw this consent at any time.
• Platform improvement: To analyse aggregate, anonymised usage patterns to improve Platform performance, game selection, and user experience.

Legal Basis for Processing

luckyi8 processes your personal data only where a valid legal basis exists for doing so. The primary legal bases relied upon by luckyi8 are as follows:

• Performance of a contract: Processing necessary to fulfil the Terms & Conditions you agreed to when registering your luckyi8 account — including account management, payment processing, and game operation.
• Legal obligation: Processing required to comply with applicable law and our gaming licence obligations, including KYC identity verification, anti-money laundering record-keeping, and responding to regulatory requests.
• Legitimate interests: Processing conducted for luckyi8's legitimate business interests where these do not override your fundamental privacy rights — including fraud detection, security monitoring, and aggregate platform analytics.
• Consent: Processing of data for marketing communications, where we rely on your freely given, specific, and withdrawable consent. You may withdraw marketing consent at any time by contacting [email protected] or using the unsubscribe mechanism in any marketing email.

Data Sharing & Disclosure

luckyi8 does not sell, rent, or trade your personal data to any third party for commercial purposes. Personal data is shared only in the limited circumstances described below, and only to the extent necessary for each specific purpose.

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, 1LINK, and Visa/Mastercard network providers receive the minimum transaction data necessary to process your deposits and withdrawals. These providers are subject to their own regulatory frameworks and data protection obligations.
• KYC and identity verification providers: Third-party identity verification services receive CNIC document data solely for the purpose of verifying your identity and age. These partners are contractually bound to process this data only for verification purposes and to delete it promptly upon completion.
• Game software providers: Licensed game providers integrated into the luckyi8 Platform receive session tokens and bet data necessary to operate individual games. They do not receive your full identity or financial profile.
• Fraud and security technology providers: Third-party risk management and fraud detection systems receive technical data including IP addresses and device fingerprints to assist in identifying prohibited activity. No identity documents are shared with these providers.
• Legal and regulatory authorities: luckyi8 will disclose personal data to law enforcement agencies, regulatory bodies, or courts where required by a valid legal order, warrant, or regulatory direction. luckyi8 will notify affected Players of such disclosures where legally permitted to do so.
• Professional advisors: Lawyers, auditors, and compliance consultants engaged by luckyi8 may access personal data on a strictly need-to-know basis under binding confidentiality agreements.

All third-party data processors engaged by luckyi8 are subject to formal data processing agreements that require them to process personal data only in accordance with luckyi8's instructions, to maintain appropriate security standards, and to delete data upon the conclusion of the relevant engagement.

International Data Transfers

luckyi8 operates as an international online gaming platform. In the course of its operations, personal data relating to Pakistani players may be transferred to and processed in jurisdictions outside Pakistan, including the jurisdictions in which luckyi8's licensing authority and data processing infrastructure are located.

Where personal data is transferred internationally, luckyi8 ensures that appropriate safeguards are in place to protect your data to a standard equivalent to or greater than the protections described in this Policy. These safeguards include:

• Standard contractual clauses incorporated into data processing agreements with all international third-party processors.
• Transfer only to processors located in jurisdictions that maintain internationally recognised data protection standards.
• Encryption of all data in transit using TLS 1.3 or equivalent standard.

Data Retention

luckyi8 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and our gaming licence obligations. The retention periods applied to each data category are set out in the data table in Section 3.

The primary retention triggers applied by luckyi8 are as follows:

• Active account: All data categories are retained throughout the active life of your luckyi8 account.
• Account closure: Identity data, financial records, and gaming history are retained for a minimum of 7 years following account closure to satisfy anti-money laundering and gaming licence record-keeping requirements. This retention obligation applies regardless of the reason for closure.
• Self-exclusion records: Records of self-exclusion and permanent account closure requests are retained permanently to prevent re-registration under the same CNIC. This is a responsible gaming safeguard, not a commercial decision.
• Marketing data: Marketing preference and consent records are retained until you withdraw consent, at which point marketing communications cease immediately. Opt-out records themselves are retained to demonstrate compliance.
• Technical and log data: Server logs, IP records, and device data are retained for 2 years for security and fraud investigation purposes, then permanently deleted.

Upon the expiry of applicable retention periods, luckyi8 securely deletes or anonymises the relevant personal data. Anonymised, aggregated data that can no longer identify any individual may be retained indefinitely for statistical and product development purposes.

Cookies & Tracking Technologies

luckyi8 uses cookies and similar tracking technologies to operate the Platform, remember your preferences, maintain your login session, and analyse aggregate Platform usage. luckyi8 does not use third-party advertising cookies or behavioural tracking technologies that profile you across external websites.

The categories of cookies used by luckyi8 are:

• Strictly necessary cookies: Essential for the Platform to function. These include session authentication tokens, CSRF protection cookies, and load-balancing cookies. These cookies cannot be disabled without breaking core Platform functionality. No consent is required for strictly necessary cookies.
• Functional cookies: Used to remember your preferences such as language settings, display preferences, and your last visited game category. These cookies improve your experience but are not essential. You may disable them in your browser settings.
• Analytics cookies: Used to collect anonymised, aggregated data about how players navigate the Platform — including pages visited, session duration, and feature usage. This data is used solely to improve Platform performance. No individual player is identified in analytics reports.

You can manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will prevent you from logging in to your luckyi8 account. For most Pakistani players using Chrome or Firefox on Android, cookie settings are accessible through the browser's Privacy & Security menu.

Your Privacy Rights

luckyi8 recognises and respects your rights in relation to your personal data. The following rights are available to all luckyi8 Players. To exercise any of these rights, contact [email protected] with the subject line "Privacy Rights Request".

Please note that certain rights are subject to legal limitations. For example, the right to erasure cannot override luckyi8's legal obligation to retain identity and financial records for 7 years following account closure under anti-money laundering regulations. In such cases, luckyi8 will explain the specific limitation that applies to your request and fulfil the request to the maximum extent legally possible.

Security Measures

luckyi8 implements a layered security architecture designed to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Our security measures include:

• Transport encryption: All data transmitted between your device and luckyi8 servers is encrypted using TLS 1.3. Connections using older, insecure protocols are rejected at the network perimeter.
• Data-at-rest encryption: All personal data stored in luckyi8 databases is encrypted using AES-256 encryption. CNIC document scans and identity files are stored in a separately encrypted, access-controlled vault with a distinct encryption key hierarchy.
• Access controls: Personal data is accessible only to luckyi8 personnel with a documented business need. Access is controlled through role-based permissions, multi-factor authentication, and comprehensive audit logging. No single employee has unrestricted access to the full player data set.
• Intrusion detection: luckyi8 operates continuous network intrusion detection and anomaly monitoring systems. Suspicious access patterns trigger automated alerts and human review within defined response timeframes.
• Penetration testing: luckyi8's Platform and data infrastructure undergo scheduled penetration testing by accredited independent security firms. Critical vulnerabilities are remediated within defined SLA windows.
• Incident response: In the event of a personal data breach that poses a risk to Player rights, luckyi8 will notify affected Players without undue delay and will take all necessary steps to contain, investigate, and remediate the breach.

Minors — 21+ Strictly Enforced

luckyi8 does not knowingly collect personal data from individuals under the age of 21. The Platform is intended exclusively for adults aged 21 years and above. luckyi8 enforces a 21+ threshold — stricter than the 18+ minimum applied by some operators — in recognition of the serious nature of online gambling and its potential impact on younger adults.

If luckyi8 discovers that personal data has been submitted by or on behalf of an individual under the age of 21, the following actions will be taken immediately:

• The relevant account will be suspended pending investigation.
• All personal data associated with the underage account will be deleted from luckyi8's active systems as soon as legally permissible.
• Any deposits made will be returned to the original payment method after deducting any bonus funds disbursed.
• The incident will be logged for regulatory reporting purposes where required by luckyi8's licensing authority.

If you are a parent or guardian and believe that a person under 21 in your household has registered a luckyi8 account, please contact [email protected] immediately. We will investigate and close the account as a priority.

Amendments to This Policy

luckyi8 reserves the right to update this Privacy Policy at any time. When material changes are made that affect the way your personal data is processed or the rights available to you, luckyi8 will:

• Publish the updated Policy on the Platform with a revised effective date prominently displayed at the top of the document.
• Send a notification to the email address registered on your luckyi8 account at least 7 days before material changes take effect.

Your continued use of the luckyi8 Platform after the effective date of any amendment to this Policy constitutes your acceptance of the revised terms. If you do not agree with any amendment, you should stop using the Platform and request account closure before the effective date of the change.

Minor amendments — such as clarifications that do not change the substance of how your data is processed, or updates to contact details — may be made without advance notice and will be reflected in the updated effective date shown at the top of this Policy.

Contact & Data Protection Officer

If you have any questions about this Privacy Policy, wish to exercise any of your privacy rights, or want to raise a concern about how luckyi8 handles your personal data, please contact us through the following channel:

1. Send an email to [email protected] with the subject line "Data Protection Request" or "Privacy Rights Request".
2. Include your registered luckyi8 username, your full name as registered on the account, and a clear description of your request or concern.
3. luckyi8 will acknowledge your request within 3 business days and provide a substantive response within 30 days. Complex requests involving large data sets or legal analysis may take up to 60 days, in which case we will notify you of the extended timeframe.

luckyi8 takes all privacy complaints seriously. If you are not satisfied with luckyi8's response to your privacy concern, you have the right to escalate your complaint to the relevant supervisory authority or to luckyi8's licensing authority as appropriate.