lucky10 Privacy Policy

lucky10 is an online gaming platform operating at lucky10.pro, providing sports betting, live casino, slot games, and related gaming services to adult users aged 21 and above. References to "lucky10," "we," "us," or "our" throughout this Privacy Policy refer to the operator of the lucky10 platform.

lucky10 acts as the data controller in respect of personal data collected from users who register accounts, access the platform, or interact with lucky10 in any capacity. As data controller, lucky10 determines the purposes and means by which your personal data is processed, and bears responsibility for ensuring that such processing complies with this Privacy Policy and applicable data protection standards.

If you have any questions about how lucky10 handles your personal data, you may contact our dedicated data protection point of contact at [email protected]. We aim to respond to all data-related enquiries within five business days.

lucky10 collects personal data through several channels: directly from you when you register or interact with the platform, automatically through your use of the platform, and — where legally required — from third-party verification providers. The categories of data we collect are set out in the table below:

lucky10 uses the personal data it collects exclusively for the following purposes. We do not use your data for any purpose that is incompatible with the original reason for its collection without your explicit consent.

• Account Management: Creating, maintaining, and securing your lucky10 Account, including authentication, password reset, and session management.
• Identity Verification (KYC): Verifying your age, identity, and — where required — the source of funds in your Account, to comply with anti-money-laundering obligations and our 21+ age restriction policy.
• Payment Processing: Facilitating PKR deposits and withdrawals via your chosen payment method, and maintaining accurate transaction records for your Account history.
• Platform Operation & Improvement: Analysing aggregated, anonymised usage data to identify technical issues, improve game performance, and enhance the overall platform experience for users across Karachi, Lahore, Islamabad, Faisalabad, and beyond.
• Fraud Prevention & Security: Detecting and preventing fraudulent transactions, unauthorised Account access, bonus abuse, and other prohibited conduct as defined in our Terms and Conditions.
• Responsible Gaming: Monitoring Account activity for indicators of problem gambling and providing access to responsible gaming tools, including deposit limits, session reminders, cooling-off periods, and self-exclusion.
• Customer Support: Responding to enquiries, resolving disputes, and maintaining a record of support interactions for quality assurance purposes.
• Legal & Regulatory Compliance: Fulfilling lucky10's obligations under applicable anti-money-laundering, responsible gaming, and data protection regulations, including responding to lawful requests from competent authorities.
• Marketing Communications: Sending you promotional offers, bonus notifications, and platform updates where you have opted in to receive such communications. You may withdraw consent for marketing communications at any time via your Account settings or by contacting support.

lucky10 processes your personal data only where a valid legal basis exists for doing so. The applicable legal basis for each processing activity is identified below:

• Contractual Necessity: Processing required to fulfil the Account agreement between you and lucky10 — including registration, payment processing, KYC verification, and customer support — is carried out on the basis that it is necessary to perform our contract with you.
• Legal Obligation: Processing carried out to comply with anti-money-laundering laws, age verification requirements, and any lawful requests from competent regulatory or law enforcement authorities is performed on the basis of a legal obligation.
• Legitimate Interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics is carried out on the basis of lucky10's legitimate interests in operating a secure, fair, and compliant platform, where those interests are not overridden by your own data protection rights.
• Consent: Processing for direct marketing communications and the use of non-essential cookies is carried out on the basis of your explicit, freely given consent. You may withdraw consent at any time without this affecting the lawfulness of processing carried out before withdrawal.

lucky10 does not sell, rent, or trade your personal data. We share data with third parties only where strictly necessary and only under contractual data protection obligations. The categories of third parties with whom lucky10 may share your data are as follows:

• Payment Processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and cryptocurrency payment gateways receive the minimum data required to process your transactions. These providers operate under their own regulatory obligations and data security standards.
• Identity Verification Providers: Third-party KYC and anti-money-laundering screening providers may receive identity and document data for the purpose of verifying your Account. Such providers are contractually prohibited from using your data for any other purpose.
• Game Content Providers: Certified RNG game suppliers and live dealer providers may receive a pseudonymised Account reference and session data to facilitate game delivery and dispute resolution. They do not receive your full identity or financial data.
• Fraud Detection & Security Services: Specialist fraud detection platforms may receive technical and usage data — such as IP address, device fingerprint, and betting patterns — for the purpose of identifying and preventing prohibited conduct.
• Regulatory & Law Enforcement Authorities: lucky10 will disclose personal data to competent authorities where required to do so by law, court order, or in response to a lawful regulatory request. lucky10 will notify affected users where legally permitted to do so.
• Professional Advisers: Lawyers, auditors, and insurers may access personal data on a need-to-know basis and under strict confidentiality obligations in connection with legal, compliance, or insurance matters.

lucky10 uses cookies and similar tracking technologies to operate essential platform functions, improve user experience, and — where you have consented — to deliver relevant promotional content. The categories of cookies used on lucky10.pro are:

• Strictly Necessary Cookies: These cookies are essential to the operation of the lucky10 platform. They enable Account login sessions, security functions, and core platform navigation. These cookies cannot be disabled without preventing core functionality.
• Performance & Analytics Cookies: These cookies collect anonymised data about how users interact with lucky10.pro — including which pages are visited most frequently and where users encounter errors. This data helps lucky10 identify and resolve technical issues and improve platform performance.
• Functional Cookies: These cookies remember your preferences — such as language settings, preferred payment method, and responsible gaming tool configurations — to provide a more personalised experience.
• Marketing Cookies: With your consent, lucky10 may use cookies to identify that you have visited the platform and to deliver relevant promotional content on the lucky10 platform itself. lucky10 does not use marketing cookies to track you across third-party websites.

You may manage your cookie preferences at any time through your browser settings. Please note that disabling certain cookie categories may affect the functionality of the lucky10 platform. Withdrawing consent for non-essential cookies will not affect data already collected prior to withdrawal.

lucky10 retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable legal or regulatory obligations. The following general retention periods apply:

• Account & Identity Data: Retained for the duration of your active Account and for a period of five years following Account closure, to comply with anti-money-laundering record-keeping requirements.
• KYC Documents: Retained for five years following Account closure or the conclusion of any related regulatory or legal matter, whichever is later.
• Financial Transaction Data: Retained for five years following each transaction to comply with financial record-keeping obligations.
• Technical & Usage Data: Retained for a maximum of 13 months from the date of collection in identifiable form, after which it is anonymised for aggregate analytics purposes.
• Customer Support Communications: Retained for three years from the date of the interaction, unless the communication relates to an ongoing dispute or legal matter.
• Marketing Consent Records: Retained for the duration of your marketing consent and for three years following withdrawal of consent, to evidence the lawful basis for prior marketing communications.

Upon expiry of the applicable retention period, lucky10 will securely delete or irreversibly anonymise the relevant data. Where deletion is not immediately possible due to backup system constraints, the data will be isolated and protected from further processing until deletion can be completed.

lucky10 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption in Transit: All data transmitted between your device and lucky10 servers is protected by TLS 1.2 or higher (256-bit SSL encryption).
• Encryption at Rest: Sensitive data stored in lucky10's systems — including KYC documents and financial records — is encrypted at rest using AES-256 encryption.
• Access Controls: Access to personal data within lucky10's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations.
• Two-Factor Authentication: lucky10 offers two-factor authentication for all user Accounts and requires it for internal administrative access to systems holding personal data.
• Penetration Testing: lucky10's platform undergoes regular security assessments, including penetration testing by independent security specialists.
• Incident Response: lucky10 maintains a documented data breach incident response procedure. In the event of a breach affecting your personal data, lucky10 will notify affected users without undue delay and take immediate remedial action.

As a lucky10 user, you hold the following rights in respect of your personal data. To exercise any of these rights, please contact lucky10 at [email protected] with a clear description of your request. lucky10 will respond within 30 days of receipt.

Please note that some rights are subject to limitations where lucky10 is required to retain or process data to comply with a legal obligation — for example, KYC records required under anti-money-laundering regulations cannot be deleted upon request before the mandatory retention period has elapsed. lucky10 will always explain the applicable limitation clearly when responding to a rights request.

lucky10 employs automated and manual age-verification processes as part of the KYC procedure applied to all new Account registrations. Where age cannot be verified to lucky10's satisfaction, Account access will remain restricted until verification is completed.

If you are a parent or guardian and have reason to believe that a minor has registered an Account with lucky10 using false information, please contact us immediately at [email protected]. We will investigate and take action within 24 hours of the report.

lucky10 supports responsible gaming initiatives that include the protection of vulnerable persons, including minors. We encourage parents and guardians to make use of parental control software on shared devices to restrict access to online gaming platforms.

lucky10 operates on infrastructure that may involve the transfer of personal data to servers or service providers located outside Pakistan. Where such transfers occur, lucky10 ensures that appropriate safeguards are in place to protect your data to the same standard required by this Privacy Policy.

Safeguards used for international transfers may include:

• Contractual data protection clauses incorporated into agreements with all third-party processors and sub-processors who receive personal data from lucky10.
• Transfers to service providers operating in jurisdictions recognised as providing an adequate level of data protection under internationally accepted standards.
• Where no adequacy decision applies, transfers are made subject to binding corporate rules or equivalent legally recognised transfer mechanisms.

You may request further information about the international transfer safeguards applicable to your personal data by contacting lucky10 support.

lucky10 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, regulatory requirements, or platform features. When we make a material change to this Policy, we will notify you by placing a prominent notice on the lucky10 platform and, where we hold a valid email address for your Account, by sending you an email notification.

The effective date at the top of this Policy will always reflect the date of the most recent revision. We encourage all lucky10 users to review this page periodically to stay informed about how we handle your personal data.

Previous versions of this Privacy Policy are available upon request by contacting [email protected].

If you have any questions, concerns, or requests relating to this Privacy Policy or the way lucky10 handles your personal data, please contact our support team using the details below. All data protection enquiries are handled with priority and in strict confidence.

• Email: [email protected] — responses within five business days for data protection matters.
• Live Chat: Available within your logged-in Account dashboard, 24 hours a day, seven days a week.

When submitting a data protection request, please clearly state the nature of your request, your Account username, and the email address registered to your Account. This will allow lucky10 to locate your records promptly and respond efficiently.

If you are not satisfied with lucky10's response to a data protection request or complaint, you have the right to escalate the matter to the relevant supervisory authority or data protection regulator applicable in your jurisdiction.