Mylucky Privacy Policy – Your Personal Data Protection

To provide you with the best possible service, mylucky collects several categories of information. We only collect data that is strictly necessary — nothing more.

In addition to information you provide directly, we also collect data automatically when you use the platform — for example through cookies, server logs and analytics tools. All such data collection is done transparently and in accordance with applicable legal provisions.

The data we collect is used for specific and legitimate purposes. mylucky does not use your data for any purpose other than those stated below:

• Account management: Creating, verifying, and maintaining your account so you can log in and use the platform seamlessly.
• Transaction processing: Handling all deposits, withdrawals, bonuses, and payments accurately and securely.
• Legal compliance: Meeting KYC, Anti-Money Laundering (AML) obligations and reporting requirements to the relevant authorities.
• Platform security: Detecting and preventing fraud, hacking, account abuse, and other suspicious activities that could compromise your security.
• Service improvement: Analyzing usage patterns to improve platform performance, user interface, and game selection.
• Essential communications: Sending account-related notices, policy updates, security information, and necessary operational messages.
• Marketing (with consent): Keeping you informed about promotions, bonuses, and special offers that may interest you — only if you choose to receive them.
• Responsible gaming: Monitoring gameplay patterns to identify signs of problem gambling and offering appropriate support.

mylucky only processes your personal data on a lawful basis. Depending on the type of data and its purpose, the processing bases we rely on are as follows:

• Contract performance: Processing required to fulfill the agreement between you and mylucky, including account management and transaction processing.
• Legal obligations: Data that must be processed to fulfil legal requirements such as KYC, AML, and tax reporting.
• Legitimate interests: Processing for security purposes, fraud prevention, and service improvement that does not affect your fundamental rights.
• Consent: For non-mandatory processing such as marketing communications, we obtain your explicit consent beforehand. You may withdraw this consent at any time.

mylucky does not sell or disclose your personal data to third parties for their own marketing purposes. However, in the course of operating the platform, we share data with selected parties under limited circumstances as follows:

• Payment service providers: Such as FPX processors, digital wallet operators and banks to facilitate your financial transactions.
• Game software providers: Licensed gaming companies that supply slots, live casino and other games on our platform — only the minimum necessary technical data is shared.
• Identity verification services: Third-party KYC providers that assist us in verifying member identities to meet compliance requirements.
• Regulatory authority: When required by law or court order, we will disclose the necessary data to the relevant authorities.
• Technical infrastructure providers: Such as cloud computing services and CDN providers that help us operate the platform — all such providers are bound by strict confidentiality agreements.

Platform mylucky uses cookies and similar tracking technologies to enhance your experience, maintain login session security and understand how users interact with our platform.

Types of cookies we use:

• Essential cookies: Required for core platform functions such as login authentication and session security. These cookies cannot be disabled as they are critical to operations.
• Performance cookies: Helping us understand which pages are visited most frequently and where users encounter issues, so we can improve the user experience.
• Functional cookies: Saving your preferences such as language, display settings, and game preferences so you do not need to reset them every time you log in.
• Marketing cookies: Used to display relevant ads and offers to you. These cookies are only active if you provide consent.

You may manage or delete cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of some platform features.

mylucky retains your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. The following are our data retention guidelines:

• Active account data: Retained for as long as your account is active and in use.
• Financial transaction data: Retained for a minimum of 7 years in accordance with accounting and AML compliance requirements.
• KYC documents: Retained for 5 years after account closure or the end of the business relationship.
• Communication & support logs: Retained for 3 years for reference and dispute resolution purposes.
• Anonymous analytics data: May be retained indefinitely as it cannot be linked to any individual's identity.

When data is no longer needed and there is no legal obligation to retain it, mylucky will securely delete or anonymise that data using industry-recognised methods.

Under Malaysia's PDPA and the privacy principles we uphold, you have the following rights regarding your personal data:

mylucky implements comprehensive technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration or destruction. These measures include:

• 256-bit SSL/TLS encryption for all data communications between client and server.
• Encryption of sensitive data stored in databases using industry-grade encryption algorithms.
• Role-based access control (RBAC) ensuring only authorized personnel can access specific data.
• 24/7 security monitoring and threat detection by our security team.
• Regular penetration testing by independent security experts to identify and patch vulnerabilities.
• Two-factor authentication (2FA) for access to internal administration systems.
• Regular data backups and tested disaster recovery procedures.

In some cases, your personal data may be transferred to, and processed in, countries other than Malaysia — for example, when we use cloud computing services or technology providers operating from multiple locations.

When such a transfer occurs, mylucky ensures data protection equivalent to Malaysia's standards is maintained through:

• Binding data processing agreements (DPA) with all international providers.
• Use of internationally recognized standard contractual clauses.
• Ensuring data recipients are located in countries with an equivalent or higher level of data protection.

mylucky reserves the right to update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or technological developments. When significant changes occur, we will:

• Sending email notices to all registered members at least 14 days before changes take effect.
• Displaying a clear notice on the platform's home page for a minimum of 7 days.
• Updating the "Last Updated" date at the top of this document.

Continued use of the platform mylucky after the effective date of the changes indicates your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal data, the mylucky privacy team mylucky here to help.