Privacy Policy lucky99 — Member Personal Data Protection

Welcome to the lucky99 Privacy Policy page. This document outlines the privacy practices of the lucky99 platform, accessible via the website lucky99.bz and the lucky99 mobile app. This policy applies to all users who register, browse, or use any of the services we offer.

We understand that your trust is our most valuable asset. That is why lucky99 takes a transparent and responsible approach to every aspect of personal data handling. This policy is written in plain language so you do not need to be a legal expert to understand how your data is managed.

By registering an account or using the lucky99 platform, you agree to the data processing practices described in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the platform and contact us to close your account.

Lucky99 collects several categories of information depending on how you interact with our platform. We only collect information that is strictly necessary to provide a high-quality, secure, and legally compliant service.

Information You Provide Directly

Automatically Collected Information

When you browse or use the lucky99 platform, our systems automatically record certain technical information required to keep the platform running smoothly and securely:

• Device data: Device type, operating system, model, and screen resolution.
• Network data: IP address, internet service provider (ISP), and estimated location based on IP.
• Activity data: Pages visited, session duration, games played, login and logout dates and times.
• Transaction data: Deposit history, withdrawals, total wagering amounts, and win history within the platform.
• Cookie and tracking data: Session cookies, preference cookies, and marketing identifiers as further described in Section 5.

Information from Third Parties

In some cases, lucky99 may receive information about you from legitimate sources such as payment processors for transaction verification, accredited third-party KYC service providers, and licensed fraud and anti-money laundering prevention bodies to ensure the security of our platform ecosystem.

Every piece of information we collect has a clear and legitimate purpose. lucky99 will not use your data for purposes unrelated to platform operations or the protection of our members' interests. The primary purposes of data use are as follows:

Account Operations & Services

• Registering and verifying new lucky99 member accounts.
• Processing deposit and withdrawal transactions accurately and securely.
• Verifying member identity through the KYC process in line with compliance requirements.
• Providing responsive and effective 24/7 customer support.
• Sending important notifications related to your account, transactions, and security.

Security & Compliance

• Detecting and preventing fraud, money laundering (AML), and suspicious activity.
• Fulfilling reporting obligations to relevant authorities in accordance with applicable law.
• Maintaining transaction records for audit and legal compliance purposes.
• Protecting the security of your account by monitoring for unusual login activity.

Experience Enhancement

• Personalizing game recommendations and promotions based on your gaming history.
• Analyzing usage patterns to improve interface design and platform performance.
• Running A/B tests to ensure new features deliver the best possible experience to members.

Lucky99 does not sell, rent, or transfer your personal data to any third party for marketing or commercial purposes. However, in the course of operating the platform safely and lawfully, we may share certain information with the following parties under limited and controlled circumstances:

Operational Service Partners

Certain lucky99 platform functions are supported by carefully selected third-party service providers. They are only permitted to access data necessary to carry out their specific tasks and are bound by strict confidentiality agreements:

• Licensed payment processors: To securely process deposit and withdrawal transactions.
• KYC & identity verification providers: To verify the authenticity of submitted identity documents.
• Cloud & infrastructure service providers: To store and process data in a secure environment.
• Platform analytics providers: To understand aggregated, anonymised usage patterns for product improvement purposes.

Legally Mandated Disclosure

Lucky99 may be required to disclose your personal information to the authorities if mandated by law, court order, or a directive from a legitimate regulatory body. In such situations, we will notify you in advance unless specifically prohibited by the applicable law.

Lucky99 uses cookies and similar tracking technologies to enhance your experience, maintain session security, and understand how members interact with our platform. The following types of cookies are used:

Types of Cookies Used

• Session cookies: Required to maintain your login status and ensure transaction security. These cookies expire automatically when you close your browser.
• Preference cookies: Saving your preferences such as language, theme, and display settings so you do not have to reconfigure them each time you log in.
• Analytics cookies: Helping us understand which pages are visited most frequently and where users encounter difficulties, without personally identifying any individual.
• Security cookies: Used to detect suspicious login attempts and protect your account from unauthorised access.

Managing Your Cookies

You may manage or delete cookies through your browser settings at any time. Please note that disabling certain cookies — especially session and security cookies — may affect the functionality of the lucky99 platform and your login experience. We recommend keeping security-related cookies active to protect your account.

Lucky99 invests seriously in security infrastructure to protect your personal information from unauthorized access, alteration, disclosure, or destruction. The following are the security layers we have implemented:

• Encryption of data in transit: All communications between your device and lucky99 servers are secured by the latest TLS/SSL protocols with 256-bit encryption.
• Encryption of data at rest: Sensitive information such as passwords is stored in hashed form that cannot be decrypted even by our internal staff.
• Internal access controls: Only authorized staff with a legitimate operational need are permitted to access member data, and every access is recorded in an audit log.
• Two-factor authentication (2FA): lucky99 fully supports two-factor authentication (2FA) for all member accounts. We encourage all members to enable this feature as an added layer of protection.
• Regular security audits: We engage independent security firms to conduct regular penetration testing and code audits.

Lucky99 retains your personal data only for as long as necessary to fulfil the purpose for which it was collected or to comply with applicable legal obligations. The following are our general data retention guidelines:

• Active account data: Retained for as long as your account is active and operational.
• Financial transaction data: Retained for a minimum of 7 years after the transaction occurs, in line with Malaysian banking and financial legal requirements.
• KYC documents: Retained for a minimum of 5 years after account closure or the end of the business relationship.
• Activity and security logs: Retained for 2 years for security incident investigation purposes if required.
• Marketing data (where applicable): Deleted within 30 days after you withdraw your marketing communication consent.

When your data is no longer needed for its original purpose or legal obligations, lucky99 will securely delete or destroy it using industry-standard methods, ensuring it cannot be recovered.

As a lucky99 member, you have certain rights regarding your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA). lucky99 fully respects these rights and makes it easy for you to exercise them:

• Right of access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You may request that we correct any inaccurate or incomplete data.
• Right to erasure: You may request deletion of your personal data under certain circumstances, subject to applicable legal obligations.
• Right to restrict processing: Under certain circumstances, you may request that we restrict how we process your data.
• Right to object: You have the right to object to the processing of your data for direct marketing purposes at any time.
• Right to data portability: You may request your data in a machine-readable format for transfer to another party.

To exercise any of the above rights, please contact the lucky99 customer support team via live chat or our support email. We will process your request within 30 days of receipt.

The lucky99 platform is intended exclusively for users who are 18 years and above. We do not knowingly collect or process personal data from minors. If you become aware that someone under the age of 18 has registered or is using our platform, please contact us immediately so we can take appropriate action, including account closure and deletion of related data.

Lucky99 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service improvements. Any significant changes will be communicated to you via in-platform notifications or your registered email before the changes take effect.

The "Last Updated" date shown at the top of this page indicates when this Privacy Policy was last reviewed. We encourage you to check this page periodically to stay informed about how your data is protected. Continued use of the lucky99 platform after any amendments take effect constitutes acceptance of the updated privacy terms.

If you have any questions, concerns, or complaints about how lucky99 handles your personal data, or if you wish to exercise any of your privacy rights, our team is ready to assist you:

• Live Chat: Available 24/7 directly within the lucky99 platform — the fastest way to get an immediate response.
• Support Email: [email protected] — for written enquiries that require documentation or supporting evidence.
• Account Section: Log in to your account and navigate to Settings > Privacy to manage your privacy preferences directly.

We are committed to responding to all privacy-related inquiries within 3 working days. For data deletion or export requests, processing may take up to 30 days depending on the complexity of the request.