luckyyi Privacy Policy

This Privacy Policy ("Policy") describes how luckyyi ("luckyyi," "we," "us," "our") collects, processes, stores, and protects the personal information of individuals ("Data Subjects," "Players," "you") who access or use the luckyyi platform available at luckyyi.app and all related services (collectively, the "Platform").

luckyyi is committed to protecting the privacy and personal data of all players in accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC") of the Philippines. Where luckyyi's obligations as a PAGCOR-regulated online gaming operator impose additional data processing requirements, those obligations are also reflected in this Policy.

This Policy should be read alongside luckyyi's Terms & Conditions and the game-specific or promotion-specific terms published on the Platform. In the event of any inconsistency, this Policy shall govern all matters relating to personal data.

luckyyi collects the following categories of personal data from players on the Platform, depending on the nature of the interaction and the services used:

luckyyi does not collect sensitive personal information (as defined under the DPA) except where strictly necessary for regulatory compliance — for example, where PAGCOR's Know Your Customer requirements mandate collection of information related to national identification numbers. Such sensitive information is collected under the lawful grounds set out in clause 4 of this Policy.

luckyyi collects personal data through the following channels and mechanisms:

• Direct collection: Information you provide when registering an account on luckyyi, completing identity verification, making deposits or withdrawals, contacting customer support, or responding to promotional communications.
• Automated collection: Technical data collected automatically when you access the luckyyi Platform — including your IP address, device identifiers, browser type, session data, and interaction logs — through the use of cookies, web server logs, and similar tracking technologies described further in clause 7.
• Third-party sources: Identity and address verification data sourced from third-party KYC service providers engaged by luckyyi to fulfil its regulatory obligations. Payment data from licensed payment processors facilitating GCash, PayMaya, and banking transactions. Fraud-prevention data from industry-standard risk management services.
• PAGCOR-directed data sharing: In compliance with PAGCOR regulations, certain player data may be shared with or received from PAGCOR's centralised gaming monitoring systems. Such processing is conducted on the basis of legal obligation as described in clause 4.

luckyyi processes personal data only where a lawful basis exists under the Data Privacy Act of 2012 and its Implementing Rules and Regulations. The primary legal bases relied upon by luckyyi are as follows:

• Contract performance: Processing necessary to provide the services described in the luckyyi Terms and Conditions — including account management, game access, deposit and withdrawal processing, and customer support. Without this processing, luckyyi cannot provide you with the services you have requested.
• Legal obligation: Processing required to comply with PAGCOR licensing conditions, Anti-Money Laundering Act (AMLA) obligations, Bureau of Internal Revenue (BIR) reporting requirements, and any other applicable Philippine law or regulatory directive. luckyyi has no discretion in respect of processing conducted on this basis.
• Legitimate interests: Processing conducted for luckyyi's legitimate business interests where such interests do not override the fundamental rights and freedoms of data subjects — including fraud prevention, platform security, responsible gaming monitoring, and service improvement activities.
• Consent: Processing for marketing and promotional communications, where required by law. You may withdraw consent for marketing communications at any time by updating your preferences in your luckyyi account settings or by contacting [email protected].

luckyyi uses the personal data it collects for the following specific purposes:

• To create, maintain, and manage your player account on the luckyyi Platform.
• To verify your identity and age in compliance with PAGCOR's Know Your Customer requirements and the minimum age requirement of 21 years.
• To process deposits, withdrawals, and other financial transactions on your behalf.
• To provide access to games, sports betting markets, and all other services offered on the luckyyi Platform.
• To monitor and detect fraudulent activity, money laundering, and other prohibited activities in compliance with AMLA and PAGCOR regulations.
• To implement responsible gaming tools — including monitoring for problem gambling indicators and providing timely interventions where necessary.
• To manage customer support requests, complaints, and dispute resolution processes.
• To send transactional communications — including deposit and withdrawal confirmations, security alerts, and account-related notifications.
• To send marketing and promotional communications where you have provided consent and where such communications are permitted under applicable law.
• To improve, personalise, and optimise the luckyyi Platform and the services offered on it, including through analysis of aggregated, anonymised usage data.
• To comply with all applicable legal and regulatory obligations, including reporting to PAGCOR, BIR, AMLC, and other Philippine government agencies as required.

luckyyi does not sell, rent, or trade your personal data to third parties for commercial purposes. Personal data is shared only in the following circumstances and with the following categories of recipients:

• Game providers and technology partners: Licensed game providers (such as JILI Games, PG Soft, and Pragmatic Play) may receive technical session data necessary to deliver their game services. These providers are engaged under data processing agreements that require them to handle player data in accordance with applicable privacy law.
• Payment processors: Personal and financial data is shared with licensed payment service providers — including GCash (Mynt), PayMaya (Voyager), BPI, BDO, Metrobank, and UnionBank — for the sole purpose of processing financial transactions. These processors are independently regulated under Bangko Sentral ng Pilipinas (BSP) rules.
• KYC and fraud prevention providers: Identity verification data is processed by third-party KYC service providers engaged by luckyyi to fulfil regulatory compliance obligations. Fraud risk data may be shared with industry anti-fraud services on a legitimate interests basis.
• Regulatory authorities: luckyyi is legally required to share player data with PAGCOR, AMLC, BIR, NPC, and other Philippine government agencies as directed by applicable law, lawful order, or regulatory requirement.
• Professional advisers: Legal, accounting, and compliance advisers engaged by luckyyi may access personal data on a strictly need-to-know basis and under confidentiality obligations.
• Business successors: In the event of a merger, acquisition, or other corporate restructuring, personal data held by luckyyi may be transferred to the successor entity, subject to applicable data privacy law requirements.

The luckyyi Platform uses cookies and similar tracking technologies to enhance your experience, maintain your session, and support the security and performance of the Platform. The following types of cookies may be placed on your device when you visit luckyyi.app:

• Strictly necessary cookies: Required for the Platform to function correctly, including session management, authentication, and security features. These cookies cannot be disabled without significantly impairing your use of the Platform.
• Performance and analytics cookies: Used to collect aggregated, anonymised information about how players interact with the Platform — including which pages are visited most frequently and how players navigate between sections. This information is used solely to improve Platform performance and user experience.
• Functional cookies: Used to remember your preferences and settings — such as your preferred language, display settings, and responsible gaming tool configurations — to personalise your experience on luckyyi.
• Security cookies: Used to detect and prevent fraudulent activity, including session hijacking and cross-site request forgery attacks. These cookies are strictly necessary for Platform security and cannot be opted out of.

luckyyi does not use third-party advertising or behavioural targeting cookies on the Platform. No cross-site tracking for advertising purposes is conducted by luckyyi.

luckyyi implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data transmitted between your device and luckyyi's servers.
• Encryption at rest for sensitive personal and financial data stored in luckyyi's databases.
• Role-based access controls limiting access to personal data to luckyyi personnel and contractors on a strict need-to-know basis.
• Multi-factor authentication requirements for luckyyi staff accessing systems containing personal data.
• Regular security audits, penetration testing, and vulnerability assessments conducted by qualified third-party security specialists.
• Incident response procedures aligned with NPC notification requirements in the event of a personal data breach.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, luckyyi will notify the NPC within 72 hours of becoming aware of the breach and will notify affected data subjects without undue delay, in accordance with the Data Privacy Act and NPC regulations.

luckyyi retains personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to any longer retention period required by applicable law or regulatory obligation. The following general retention periods apply:

• Account and identity data: Retained for the duration of your active account and for a minimum of five (5) years following account closure, in compliance with PAGCOR record-keeping requirements and AMLA obligations.
• Financial transaction data: Retained for a minimum of ten (10) years from the date of the transaction, in accordance with AMLA record-keeping requirements applicable to covered entities.
• Gaming activity data: Retained for five (5) years following account closure, or longer if required for ongoing regulatory investigation or legal proceedings.
• Customer support communications: Retained for three (3) years from the date of the interaction, or until the resolution of any outstanding complaint or dispute, whichever is later.
• Marketing preferences and consent records: Retained for the duration of the marketing relationship and for three (3) years thereafter to demonstrate consent compliance.

Upon expiry of the applicable retention period, personal data will be securely deleted, anonymised, or archived in a manner that renders it no longer attributable to an identifiable individual, in accordance with NPC guidelines on data disposal.

As a data subject under Republic Act 10173 (the Data Privacy Act of 2012), you have the following rights in relation to your personal data held by luckyyi:

• Right to be informed: You have the right to be informed of the personal data luckyyi collects about you, the purposes for which it is processed, and the identity of third parties with whom it is shared.
• Right of access: You have the right to request a copy of the personal data luckyyi holds about you and information about how it is being processed.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal data held about you.
• Right to erasure or blocking: You have the right to request deletion or blocking of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (where consent was the lawful basis), or where processing is unlawful. This right is subject to luckyyi's legal obligations to retain certain data as described in clause 9.
• Right to data portability: You have the right to receive personal data you have provided to luckyyi in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to the processing of your personal data where luckyyi relies on legitimate interests as the lawful basis for processing, including profiling.
• Right to damages: You have the right to claim compensation for any damage suffered as a result of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal data.
• Right to file a complaint: You have the right to file a complaint with the National Privacy Commission if you believe your rights under the Data Privacy Act have been violated. The NPC's contact information is available at the NPC's official website.

The luckyyi Platform is strictly intended for adults who are at least twenty-one (21) years of age. luckyyi does not knowingly collect or process personal data from persons under the age of 21.

If luckyyi determines — through age verification procedures, KYC documentation review, or any other means — that a user account has been registered by or on behalf of a person under 21 years of age, the account will be immediately suspended, all funds will be returned to the originating payment method (less any applicable processing fees), and all personal data associated with the account will be deleted as soon as is reasonably practicable, subject only to retention obligations imposed by applicable law.

luckyyi's primary operations and data processing infrastructure are based in the Philippines. However, certain service providers engaged by luckyyi — including some game providers and technical infrastructure vendors — may process personal data outside of the Philippines.

Where personal data is transferred to a country or territory outside the Philippines, luckyyi ensures that appropriate safeguards are in place to protect your data in accordance with the Data Privacy Act's requirements for cross-border transfers. These safeguards may include:

• Contractual provisions requiring the recipient to apply data protection standards equivalent to those required under Philippine law.
• Transfers to recipients located in jurisdictions that the NPC has recognised as providing an adequate level of data protection.
• Binding corporate rules where personal data is transferred within a group of companies that has adopted NPC-compliant privacy policies.

You may request information about the specific cross-border transfer mechanisms used by luckyyi by contacting the Data Protection Officer at the contact details set out in clause 14.

luckyyi reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. Material changes to this Policy will be communicated to registered players by email to the address on record and/or by prominent notice on the luckyyi Platform, no less than seven (7) calendar days before such changes take effect — except where immediate implementation is required to comply with a legal or regulatory obligation.

The "Last Updated" date and version number displayed at the top of this page and in the policy header will be updated to reflect the date of the most recent revision. Your continued use of the luckyyi Platform following the effective date of any updated Privacy Policy constitutes your acknowledgment of the updated Policy.

We encourage you to review this Privacy Policy periodically. If the updated Policy requires your fresh consent for any processing activity that previously relied on consent, we will seek that consent from you separately before commencing the updated processing.

luckyyi has designated a Data Protection Officer ("DPO") as required under the Data Privacy Act and NPC regulations. The DPO is responsible for overseeing luckyyi's compliance with the Data Privacy Act, handling data subject rights requests, and serving as the point of contact for the National Privacy Commission.

For all privacy-related enquiries, data subject rights requests, consent withdrawals, or data breach reports, please contact the luckyyi DPO using the following details:

• Email: [email protected] (clearly mark your email "Data Privacy Request" or "DPO" in the subject line)
• Response Time: luckyyi aims to acknowledge all privacy requests within two (2) business days and to substantively respond within fifteen (15) business days of receiving a verifiable request
• Language: Requests may be submitted in English

If you are not satisfied with luckyyi's response to your privacy request or complaint, you have the right to escalate the matter to the National Privacy Commission of the Philippines. The NPC accepts complaints from data subjects in accordance with its published complaints handling procedures.