luckpot Privacy Policy

Introduction

This Privacy Policy ("Policy") describes how luckpot ("luckpot," "we," "us," or "our"), the operator of the online gaming platform accessible at luckpot.vip, collects, uses, stores, discloses, and protects the personal information of players and visitors ("you," "your," or "Data Subject").

This Policy is issued in compliance with Republic Act No. 10173, the Data Privacy Act of 2012 ("DPA"), and its Implementing Rules and Regulations, as enforced by the National Privacy Commission of the Philippines ("NPC"). It forms part of luckpot's overall compliance framework alongside the Terms & Conditions and all other policies published on the platform.

By registering a luckpot account, using luckpot services, or otherwise providing personal information to luckpot, you acknowledge that you have read and understood this Policy and consent to the processing of your personal data as described herein.

Data Controller

luckpot is the personal information controller responsible for the personal data collected through luckpot.vip and related platforms. Our designated Data Protection Officer ("DPO") oversees all data privacy compliance activities and can be contacted at:

• Email: [email protected] (subject line: "Data Privacy — DPO")
• Platform: Via Live Chat at luckpot.vip, available 24/7

Requests relating to the exercise of your data subject rights should be directed to the DPO. luckpot targets an initial response to all DPO inquiries within five (5) business days.

Personal Data We Collect

luckpot collects the following categories of personal data, depending on the services you use:

luckpot does not collect sensitive personal information beyond what is strictly necessary for KYC compliance and anti-money laundering obligations.

How We Collect Your Data

luckpot collects personal data through the following means:

• Direct submission: Information you provide when registering an account, completing KYC verification, making a deposit or withdrawal request, or contacting support;
• Automated collection: Technical and usage data collected automatically when you access the platform, including via cookies and server logs (see Section 8);
• Payment processors: Transaction confirmation data received from GCash, Maya, BPI, BDO, Metrobank, InstaPay, and other payment partners when you transact with luckpot;
• Identity verification services: Data received from third-party KYC verification providers engaged by luckpot to validate government-issued Philippine identification documents;
• Third-party sources: Fraud prevention databases and AML screening services used to comply with the Anti-Money Laundering Act (AMLA) and related regulations.

Purposes of Processing

luckpot processes your personal data for the following specific, legitimate purposes:

1. Account creation and management — to register, authenticate, and maintain your luckpot player account;
2. KYC verification — to verify your identity and age (21+ requirement) in compliance with PAGCOR oversight guidelines and AML obligations;
3. Payment processing — to process deposits from and withdrawals to GCash, Maya, and other linked payment methods in PHP;
4. Anti-Money Laundering compliance — to screen transactions and player profiles against AML databases as required under Republic Act No. 9160 (AMLA) and amendments;
5. Responsible gaming — to monitor player activity for signs of problem gambling and to administer self-imposed limits, cooling-off periods, and self-exclusion requests;
6. Fraud prevention and security — to detect and prevent unauthorised access, fraudulent transactions, and account compromise;
7. Customer support — to investigate and resolve player queries, complaints, and disputes;
8. Platform improvement — to analyse aggregated usage patterns and improve the luckpot experience for Filipino players;
9. Marketing communications — where you have given explicit consent, to send promotional offers, bonus notifications, and platform updates.

Legal Bases for Processing

luckpot processes personal data on the following legal bases as recognised under the Data Privacy Act of 2012:

• Contractual necessity: Processing required to fulfil our obligations under the luckpot Terms & Conditions, including account management, payment processing, and KYC verification;
• Legal obligation: Processing required to comply with AML legislation, PAGCOR oversight requirements, and NPC regulations;
• Legitimate interests: Fraud prevention, platform security, and responsible gaming monitoring, where these interests do not override your fundamental rights;
• Consent: Direct marketing communications and optional personalisation features, where you have provided explicit, informed, and freely given consent. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Data Sharing & Third-Party Disclosure

luckpot does not sell, rent, or trade your personal data to any third party for commercial purposes. Personal data is shared only in the following limited circumstances:

• Payment processors: GCash (G-Xchange, Inc.), Maya (Voyager Innovations), and other licensed payment service providers, solely to process your transactions;
• KYC and identity verification providers: Third-party services engaged to verify government-issued Philippine identification documents;
• AML and fraud screening services: Third-party compliance databases used to fulfil legal obligations under AMLA;
• Game content providers: Aggregate, anonymised technical data shared with game providers for platform performance monitoring — no personally identifiable information is shared;
• Regulatory authorities: Disclosure to PAGCOR, the NPC, the Anti-Money Laundering Council (AMLC), or other competent Philippine authorities where required by law or regulatory directive;
• Professional advisors: Legal counsel, auditors, and compliance consultants, bound by strict confidentiality obligations.

All third parties to whom luckpot discloses personal data are contractually required to maintain appropriate data protection standards consistent with the DPA and its IRR.

Cookies & Tracking Technologies

luckpot uses cookies and similar tracking technologies on luckpot.vip for the following purposes:

• Essential cookies: Required for the platform to function — maintaining your login session, storing your language preference, and keeping your active game state. These cannot be disabled without impairing platform functionality;
• Security cookies: Used to detect and prevent fraudulent activity, enforce device trust settings, and support 2FA;
• Analytics cookies: Used to collect anonymised data on platform usage patterns to improve luckpot's products and features. No personally identifiable information is contained in analytics data;
• Preference cookies: Used to remember your platform settings, including responsible gaming limits you have voluntarily set.

You may manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using luckpot's core services, but may affect certain personalisation features.

Data Retention

luckpot retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following minimum retention periods:

• Account and KYC records: Retained for a minimum of five (5) years following account closure, as required by AMLA and applicable gaming regulations;
• Financial transaction records: Retained for a minimum of ten (10) years in line with Philippine AML record-keeping requirements;
• Support communications: Retained for three (3) years from the date of the last communication;
• Marketing consent records: Retained until consent is withdrawn, plus one (1) year thereafter as a compliance record;
• Technical and security logs: Retained for up to two (2) years for fraud prevention and incident investigation purposes.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with luckpot's data disposal procedures.

Data Security

luckpot implements technical and organisational security measures appropriate to the risks associated with processing player personal data, including:

• 256-bit SSL/TLS encryption on all data transmitted between your device and luckpot's servers;
• Bcrypt hashing of all account passwords — luckpot never stores your password in plain text;
• Two-factor authentication (2FA) available on all player accounts;
• Role-based access controls limiting employee access to personal data to authorised personnel only;
• Regular penetration testing and security audits by independent third parties;
• Segregated network architecture separating player data systems from public-facing infrastructure;
• A documented Data Breach Response Plan compliant with the NPC's mandatory breach notification requirements (72-hour notification window for qualifying breaches).

Despite these measures, no online platform can guarantee absolute security. You are encouraged to use a strong unique password and enable 2FA to maximise your account's protection.

Your Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by luckpot:

To exercise any of the above rights, contact luckpot's DPO at [email protected] with the subject line "Data Subject Rights Request." luckpot will respond within fifteen (15) business days, extendable to thirty (30) days for complex requests, as permitted under the DPA IRR.

Children's Privacy

luckpot is an online gambling platform strictly restricted to individuals aged 21 years and older. luckpot does not knowingly collect personal data from any person under 21 years of age. Where luckpot discovers or has reasonable grounds to suspect that an account has been registered by or on behalf of a minor, luckpot will immediately suspend the account, void any transactions conducted under it, and permanently delete all associated personal data in accordance with its data disposal procedures.

If you believe a minor has registered a luckpot account, please notify the DPO immediately at [email protected].

Cross-Border Data Transfers

Some of luckpot's third-party service providers — including technology infrastructure providers, KYC verification services, and game content providers — may process personal data outside the Philippines. In all such cases, luckpot ensures that appropriate safeguards are in place to protect your data to a standard at least equivalent to that required under the Data Privacy Act of 2012, including:

• Data processing agreements incorporating the NPC's standard contractual clauses for cross-border data transfers;
• Transfer only to jurisdictions or processors that have been assessed as providing adequate data protection;
• Ongoing monitoring of third-party data handling practices.

Changes to This Policy

luckpot reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or platform features. Material changes will be notified to you via the email address registered to your luckpot account no less than seven (7) days before the revised Policy takes effect.

The "Last Updated" date at the top of this Policy indicates the date of the most recent revision. Your continued use of luckpot following the effective date of a revised Policy constitutes acceptance of the updated terms. If you do not accept a revised Policy, you should close your account before the effective date.

Contact & Data Protection Officer

For any privacy-related queries, data subject rights requests, or data breach reports, please contact luckpot's Data Protection Officer:

• Email: [email protected] (subject: "Data Privacy — DPO")
• Live Chat: Available 24/7 on luckpot.vip
• Response commitment: Initial acknowledgement within 2 business days; substantive response within 15 business days

If you believe luckpot has failed to adequately address a data privacy concern, you have the right to lodge a complaint directly with the National Privacy Commission of the Philippines. Information on filing a complaint is available on the NPC's official website at privacy.gov.ph (not linked here as an external link — please search directly).