Privacy Policy
by lucy97

lucy97 (referred to in this policy as "the Company," "we," "us," or "our") operates the online casino and sports betting platform accessible at lucy97.com. The Company acts as the data controller in respect of personal data collected through registration, use of the platform, and related communications. For the purposes of this Privacy Policy, "personal data" means any information that identifies or could reasonably be used to identify you as an individual — including your name, CNIC number, mobile number, email address, payment details, and IP address.

Questions, requests, or complaints relating to the handling of your personal data under this policy should be directed to our Data Protection contact at [email protected]. We are committed to responding to all data-related correspondence within one business day and to resolving substantive requests within the timeframes described in Section 10.

The following categories of personal data are collected by lucy97 in the course of providing our platform and services to Pakistani players:

We do not collect sensitive personal data such as racial or ethnic origin, religious beliefs, or health information unless specifically required for responsible gaming interventions under Section 4 and with your explicit consent.

lucy97 collects personal data through the following channels:

• Direct submission: Information you provide when registering an account, completing KYC verification, making deposits or withdrawal requests, contacting support, or filling in any platform form.
• Automated technical collection: Data collected automatically as you browse and interact with the lucy97 platform, including cookies, server logs, session tracking, and device fingerprinting used for fraud prevention.
• Payment processors: Transaction confirmation data received from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, 1LINK, MCB, GrabPay, and Retail Cash partners when you conduct financial transactions on the platform.
• KYC verification partners: Where third-party identity verification services are used to validate your CNIC or authenticate your identity, we receive the outcome and supporting data from those services.
• Responsible gaming monitoring: Internally generated data from our platform's behavioural monitoring systems designed to detect indicators of problem gambling — including escalating deposit frequency, failed self-exclusion circumvention attempts, and distress patterns in support communications.

lucy97 processes your personal data only for legitimate, specified purposes. The following table sets out each processing purpose and its corresponding justification:

• Account creation and management: To register your Account, maintain your player profile, process login authentication, and keep your account details up to date.
• Payment processing: To facilitate PKR deposits and withdrawals via your verified JazzCash, EasyPaisa, or bank account, and to maintain accurate transaction records.
• KYC and age verification: To verify your identity, confirm you are 21 years of age or older, and comply with anti-money laundering obligations. This is a legal requirement and cannot be opted out of.
• Platform security and fraud prevention: To detect, investigate, and prevent unauthorised account access, multi-accounting, bonus abuse, payment fraud, and other prohibited conduct described in our Terms & Conditions.
• Regulatory compliance: To fulfil reporting obligations under applicable international gaming licensing standards, including AML transaction monitoring and suspicious activity reporting.
• Responsible gaming: To identify players displaying indicators of problem gambling, apply account restrictions where warranted, and maintain self-exclusion records permanently. This is a core player protection function.
• Customer support: To respond to your queries, process complaints, and maintain correspondence records for quality assurance purposes.
• Marketing communications (opt-in only): To send promotional offers, PSL seasonal bonus notifications, and platform updates to players who have explicitly opted in to receive such communications.
• Platform improvement: To analyse aggregated, anonymised usage data to improve game offerings, platform performance, and user experience for Pakistani players.

Every instance of personal data processing at lucy97 is grounded in one or more of the following legal bases under applicable international data protection standards:

• Contractual necessity: Processing required to perform the contract between you and lucy97 — including account operation, payment processing, and game delivery.
• Legal obligation: Processing required to comply with applicable law, including KYC/AML requirements, age verification, and regulatory reporting obligations.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and anonymised analytics, where our legitimate business interests are not overridden by your data protection rights.
• Consent: Processing for optional marketing communications, where you have provided a clear and freely given opt-in. You may withdraw consent at any time through your account settings or by contacting support.

lucy97 does not sell, rent, or trade your personal data. We share data only in the following strictly controlled circumstances:

• Payment processors: JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, Raast, 1LINK, MCB, GrabPay, and Retail Cash partners receive only the transaction data necessary to process your specific deposit or withdrawal. These partners operate under their own privacy policies and are contractually bound to handle data securely.
• KYC and identity verification providers: Third-party verification services receive identity documents submitted during KYC solely for the purpose of identity authentication. They are prohibited from using this data for any other purpose.
• Game content providers: Third-party live casino and slot providers may receive anonymised session identifiers necessary to deliver game content. They do not receive your name, CNIC, or financial details.
• Regulatory and law enforcement authorities: We are legally obligated to disclose personal data to competent authorities upon receipt of a lawful request, court order, or where required by AML and gaming compliance regulations. We will notify you of such disclosures where legally permitted to do so.
• Professional advisors: Legal counsel, auditors, and compliance consultants engaged by the Company may access personal data where strictly necessary and under binding confidentiality obligations.

lucy97 uses cookies and similar technologies on its platform. The following categories of cookies are in use:

• Strictly necessary cookies: Essential to the operation of the platform. These enable login authentication, session management, and security functions. They cannot be disabled without breaking core platform functionality.
• Functional cookies: Remember your preferences such as language settings, preferred payment method display, and responsible gaming limit configurations to improve your experience.
• Analytical cookies: Collect anonymised data about how players use the platform — which pages are visited, session duration, and navigation paths — to help us improve platform design and game discovery.
• Security cookies: Used for fraud detection, bot prevention, and device fingerprinting to protect your account from unauthorised access.

Marketing or third-party advertising cookies are not deployed on the lucy97 platform. You may manage cookie preferences through your browser settings. Note that disabling strictly necessary cookies will impair your ability to use the platform.

Personal data is retained by lucy97 only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Active account data: Retained for the full duration your account remains open, plus five (5) years after closure to meet AML record-keeping obligations.
• KYC documents: Retained for five (5) years from the date of verification or account closure, whichever is later, as mandated by anti-money laundering compliance standards.
• Transaction records: Retained for five (5) years from the date of each transaction for financial audit and AML compliance purposes.
• Support communications: Retained for two (2) years from the date of the last interaction for quality assurance and dispute resolution purposes.
• Self-exclusion records: Retained permanently. A player who has self-excluded cannot have their exclusion record deleted, as this record is essential to enforcing the exclusion if the player attempts to re-register.
• Marketing opt-in records: Retained for the period your opt-in consent remains active, plus three (3) years thereafter as evidence of your consent decision.

On expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised so that it can no longer be associated with you as an individual.

lucy97 implements a multi-layered security framework to protect your personal data against unauthorised access, loss, alteration, or disclosure. Key security measures in place include:

• AES-256 encryption for all personal data stored on lucy97 servers;
• TLS 1.3 encryption for all data transmitted between your device and our platform;
• Multi-factor authentication requirements for administrative access to systems holding personal data;
• Role-based access controls ensuring staff can only access personal data relevant to their specific job function;
• Regular penetration testing and vulnerability scanning of platform infrastructure;
• Segregation of payment credential data, which is handled exclusively by PCI-DSS compliant payment processors and never stored on lucy97 servers in raw form;
• Incident response procedures including the 72-hour breach notification commitment described in our principles above.

While we maintain robust technical and organisational security measures, no system is entirely immune to risk. You are also responsible for maintaining the security of your own account by using a strong, unique password, not sharing your credentials, and logging out of shared devices. Report any suspected account compromise immediately to support.

As a player on lucy97, you hold the following rights in relation to your personal data. All requests should be submitted to [email protected] and will be processed within thirty (30) days at no charge:

• Right of Access: You may request a copy of all personal data held about you by lucy97, together with information about how it is being used.
• Right to Rectification: Where your personal data is inaccurate or incomplete, you may request that it be corrected. Corrections to KYC identity data will require re-submission of supporting documentation.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected and no legal retention obligation requires us to keep it. This right is subject to our AML and compliance retention obligations described in Section 8.
• Right to Restrict Processing: You may request that we restrict the processing of your data — meaning we hold it but do not actively use it — where you contest its accuracy, object to processing, or require it for a legal claim.
• Right to Data Portability: You may request your personal data in a structured, machine-readable format for transfer to another service provider where technically feasible.
• Right to Object: You may object at any time to processing based on legitimate interests, including profiling for marketing purposes. You may also withdraw marketing consent at any time through your account settings.
• Rights related to Automated Decisions: Where an automated decision has a material impact on your account (such as a fraud-triggered freeze), you have the right to request human review.

lucy97 sends promotional communications — including PKR bonus offers, PSL season promotions, new game announcements, and platform updates — only to players who have explicitly opted in to receive such messages at the point of registration or through their account settings. We never send unsolicited marketing communications.

You may opt out of marketing communications at any time by:

• Updating your notification preferences in the Account Settings section of the platform;
• Clicking the unsubscribe link in any marketing email sent by lucy97;
• Contacting support at [email protected] with a request to be removed from all marketing lists.

Opting out of marketing will not affect transactional communications — account statements, withdrawal confirmations, KYC requests, and responsible gaming notifications are not marketing communications and will continue to be sent as necessary for account operation.

The lucy97 platform is strictly restricted to individuals who are 21 years of age or older. We do not knowingly collect personal data from any person under the age of 21. Age verification is a mandatory step in the KYC process and is enforced at account registration.

If the Company becomes aware that personal data has been collected from a minor — through misrepresentation at registration or any other means — the Account will be immediately suspended, all data relating to that minor will be securely deleted to the extent permitted by law, and the matter may be referred to relevant authorities.

Parents or guardians who believe a minor may have registered on lucy97 using false age information should contact [email protected] immediately. We treat such reports with the highest priority and respond within 24 hours.

The lucy97 platform may display content delivered by third-party game providers (live casino streams, slot game interfaces). While these providers are bound by contractual data processing agreements with lucy97, their own privacy practices govern any direct interaction you have with their software interfaces. We recommend reviewing the privacy documentation of any third-party game provider whose content you interact with.

lucy97 is not responsible for the privacy practices of external websites or services that you access independently outside of our platform. This Privacy Policy applies solely to data collected and processed by lucy97 through lucy97.com and its associated platform services.

lucy97 reserves the right to update this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform features. Material changes — meaning changes that meaningfully affect how we use your personal data — will be communicated via email to your registered address and/or a prominent notice displayed on the platform at least seven (7) days before the change takes effect.

Minor updates, such as clarifications, corrections, or formatting improvements that do not change the substance of how your data is used, may be made without advance notice. The effective date shown at the top of this document will always reflect the most recent revision. Continued use of the lucy97 platform after a policy update takes effect constitutes your acceptance of the revised policy.

The current version of this Privacy Policy is always available at lucy97.com/privacy-policy. If you have concerns about any proposed change, you are encouraged to contact our team at [email protected] before the effective date.

For all data protection enquiries, rights requests, or privacy-related complaints, please contact the lucy97 Data Protection team using the details below. We are committed to responding to all enquiries within one business day and to resolving substantive requests within thirty (30) days.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the relevant data protection supervisory authority applicable in your jurisdiction. We will cooperate fully with any such regulatory review.