luckypot Privacy Policy

§ 1 Scope & Data Controller

This Privacy Policy applies to all personal data collected and processed by luckypot in connection with the luckypot.vip website, mobile browser experience, account registration, gameplay, payment processing, customer support interactions, and any promotional communications.

Data Controller: luckypot (operating luckypot.vip) is the Personal Information Controller (PIC) as defined under the Data Privacy Act of 2012 (Republic Act No. 10173, "DPA") and its Implementing Rules and Regulations. As PIC, luckypot determines the purposes and means of processing your personal data.

This Policy applies to data subjects who are residents of the Philippines and to any individual who registers a luckypot account from any jurisdiction where access is legally permitted. Where specific provisions of RA 10173 apply more strictly than the general provisions of this Policy, the RA 10173 standard prevails.

§ 2 Personal Data We Collect

luckypot collects the following categories of personal data in the operation of its platform:

§ 3 How We Collect Your Data

luckypot collects personal data through the following channels:

• Direct submission — information you provide during registration, KYC submission, deposit/withdrawal requests, and support interactions;
• Automated technical collection — session data, device fingerprint, IP address, and browser metadata collected automatically when you access luckypot.vip;
• Payment processors — transaction confirmation data returned by GCash, Maya, BPI, BDO, Metrobank, UnionBank, Coins.ph, and Visa/Mastercard networks upon transaction completion;
• KYC verification providers — identity document verification results returned by luckypot's contracted KYC service provider;
• Game providers — session and outcome data returned by third-party game content suppliers whose games are embedded within the luckypot platform;
• Cookies and similar technologies — as described in Section 7 of this Policy.

§ 4 Why We Use Your Personal Data

luckypot processes your personal data for the following specific purposes:

4.1 Account Management and Service Delivery

To register and maintain your luckypot account, authenticate your identity at login, process deposits and withdrawals, credit bonuses, record game session outcomes, and provide customer support. This processing is necessary to fulfill luckypot's contractual obligations to you as an account holder.

4.2 Identity Verification and KYC Compliance

To verify your age (21+ requirement) and identity before processing withdrawals, consistent with luckypot's obligations under PAGCOR regulations and the Anti-Money Laundering Act (RA 9160, as amended). luckypot is legally required to maintain KYC records and cannot waive this requirement for any player.

4.3 Regulatory Reporting

To fulfill transaction monitoring, suspicious transaction reporting (STR), and covered transaction reporting (CTR) obligations to the Anti-Money Laundering Council (AMLC) and any other obligation arising from applicable PAGCOR, BSP, or Philippine government directives.

4.4 Fraud Prevention and Security

To detect and prevent unauthorized account access, payment fraud, identity misrepresentation, multi-accounting, bonus abuse, and money laundering. Technical data including IP addresses and device fingerprints are used for anomaly detection and access security.

4.5 Responsible Gaming Obligations

To manage your responsible gaming settings (deposit limits, session timers, self-exclusion), monitor for behavioral indicators of problem gambling, and fulfill any PAGCOR responsible gaming reporting requirements. This processing is a legal obligation and cannot be opted out of.

4.6 Service Improvement and Analytics

To analyze platform usage patterns, optimize game loading performance, improve payment flow user experience, and prioritize feature development. Analytics processing uses aggregated or pseudonymized data where individual-level data is not required.

4.7 Marketing Communications

To send you promotional offers, bonus alerts, game release notifications, and tournament invitations where you have opted in to marketing communications. You may withdraw marketing consent at any time through Account Settings or by contacting support@luckypot.vip. Withdrawal of marketing consent does not affect your ability to use luckypot.

§ 5 Legal Basis for Processing

Under the Data Privacy Act of 2012, luckypot processes your personal data on the following legal bases:

• Contract performance — processing necessary to deliver the account, payment, and gaming services you have contracted for with luckypot;
• Legal obligation — processing required to comply with PAGCOR regulations, AMLA obligations, NPC requirements, and other applicable Philippine law;
• Legitimate interests — fraud detection, platform security, and service improvement, where luckypot's legitimate interests are not overridden by your privacy rights;
• Consent — marketing communications, where you have explicitly opted in. Consent may be withdrawn at any time without affecting other processing.

§ 6 Data Sharing and Third-Party Disclosure

luckypot does not sell, rent, or trade your personal data to third parties for their own commercial or marketing purposes under any circumstances. Data is shared with third parties only in the following controlled circumstances:

• Payment processors — GCash (Globe Fintech Innovations), Maya (Voyager Innovations), BancNet, Visa/Mastercard networks, and other payment intermediaries receive transaction data necessary to execute your deposits and withdrawals. Each processor has its own privacy obligations under applicable Philippine and international law.
• KYC verification providers — luckypot's contracted identity verification service receives your identity document data to perform age and identity verification. These providers are bound by data processing agreements and may not use your data for any other purpose.
• Game content suppliers — third-party game developers whose titles are available on luckypot receive session data (player identifier, bet, outcome) necessary to operate their games within the luckypot platform. Identifiable personal data is minimized in these transmissions.
• Regulatory authorities — PAGCOR, AMLC, the National Privacy Commission, and other competent Philippine government authorities where required by law, court order, or legitimate regulatory request.
• Technology service providers — cloud hosting, cybersecurity, and analytics service providers engaged by luckypot under binding data processing agreements that restrict use of your data to luckypot's instructions only.
• Corporate transactions — in the event of a merger, acquisition, or sale of luckypot's business, your data may be transferred to the acquiring entity subject to equivalent privacy protections and notice to you.

§ 7 Cookies & Tracking Technologies

luckypot uses cookies and similar technologies (session tokens, local storage) on luckypot.vip. These serve the following functions:

7.1 Strictly Necessary Cookies

Session cookies that maintain your authenticated login state, remember your balance display preferences, and enable the cashier to function correctly. These cannot be disabled without rendering luckypot unusable and do not require consent under applicable law.

7.2 Performance & Analytics Cookies

Cookies that collect pseudonymized information about how players navigate luckypot.vip — page load times, error events, feature interaction rates — used to improve platform performance. Data is aggregated and not linked back to individual accounts for this purpose.

7.3 Security Cookies

Device fingerprint and session integrity cookies used to detect anomalous login attempts, enforce session expiry for security, and support fraud detection systems. These are part of luckypot's security infrastructure and process data under legitimate interest and contractual grounds.

luckypot does not use advertising or cross-site tracking cookies. Most modern browsers allow you to control cookie settings — however, disabling strictly necessary cookies will impair your ability to log in to and use luckypot.

§ 8 Data Retention

luckypot retains your personal data for the following periods:

• Account and identity data — for the duration of your account plus five (5) years after account closure, consistent with AMLA record-keeping obligations (RA 9160, Section 9).
• Transaction records — five (5) years from the date of each transaction, as required by AMLA and general accounting obligations.
• Gaming session logs — three (3) years from the date of each session, unless a longer period is required for open dispute resolution or regulatory investigation.
• KYC documents — five (5) years after account closure, consistent with AMLA requirements.
• Support correspondence — two (2) years from the date of the most recent interaction in a thread, unless related to an open complaint or legal matter.
• Marketing consent records — three (3) years from the date of last opt-in, or until consent is withdrawn (whichever is earlier).
• Self-exclusion records — permanently, to prevent re-registration during an active exclusion period and to maintain audit records of responsible gaming measures taken.

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized. Data subject to an active regulatory investigation or legal proceeding is retained until the matter is concluded regardless of the standard retention schedule.

§ 9 Security Measures

luckypot implements the following technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction:

• Encryption in transit — TLS 1.3 with 256-bit AES cipher for all data transmission between your browser and luckypot's servers;
• Encryption at rest — AES-256 encryption for stored personal data and financial records;
• Access controls — role-based access control (RBAC) limiting luckypot staff to data access required for their specific function, with access logging and periodic access review;
• Password hashing — account passwords stored as bcrypt hashes with per-user salts; plaintext passwords are never stored;
• Two-factor authentication — available to all players and required for luckypot staff accessing player data systems;
• Anomaly detection — automated monitoring for unusual access patterns, login anomalies, and data exfiltration indicators;
• Penetration testing — periodic third-party security assessments of luckypot's infrastructure and web application;
• Incident response — documented breach response procedures with NPC notification timelines consistent with RA 10173 Section 20.

§ 10 Your Rights Under RA 10173

As a data subject under the Data Privacy Act of 2012, you have the following enforceable rights with respect to your personal data held by luckypot:

To exercise any of the above rights, submit a request to luckypot's Data Protection Officer (DPO) at support@luckypot.vip with the subject line "Data Rights Request — [Right Type]". luckypot will acknowledge your request within two (2) business days and provide a substantive response within fifteen (15) business days. Identity verification will be required before processing requests.

§ 11 Children's Privacy

§ 12 Cross-Border Data Transfers

luckypot may transfer personal data to service providers located outside the Philippines in connection with cloud hosting, cybersecurity monitoring, KYC verification, and game content delivery. All cross-border transfers of personal data are conducted in accordance with Section 21 of RA 10173 and NPC Circular 16-01, which requires that:

• The recipient country offers a level of data protection substantially equivalent to RA 10173; or
• Adequate contractual protections (such as standard data protection clauses) are in place between luckypot and the receiving entity; or
• The data subject has consented to the transfer after being informed of the risks.

luckypot enters into binding data processing agreements with all international service providers that restrict the use of Filipino players' data to the specific purposes authorized by luckypot and prohibit onward transfer without luckypot's consent.

§ 13 Updates to This Privacy Policy

luckypot reviews this Privacy Policy at least annually and updates it whenever material changes to data practices occur, new legal obligations arise, or regulatory guidance from the NPC or PAGCOR requires adjustments.

For material changes — those that affect the legal basis for processing, the types of data collected, the third parties data is shared with, or your rights — luckypot will:

1. Send a notification email to your registered address at least fourteen (14) days before the change takes effect;
2. Display a prominent notice on the luckypot.vip platform for the same period; and
3. Update the "Effective Date" and "Last Reviewed" fields at the top of this page.

For non-material changes (typographical corrections, clarifications that do not alter substance), luckypot may update the Policy without advance notice, updating the Last Reviewed date accordingly. Continued use of luckypot after an updated Privacy Policy takes effect constitutes acceptance of the updated Policy.

§ 14 Contact Information & Data Protection Officer

luckypot has designated a Data Protection Officer (DPO) as required under Section 21(a) of the DPA's IRR and NPC Circular 16-01. The DPO is responsible for ensuring luckypot's compliance with RA 10173 and its implementing regulations, handling data subject rights requests, and serving as the primary point of contact with the National Privacy Commission.

This Privacy Policy was last reviewed and updated on 1 January 2026. luckypot is committed to keeping this document current and accurate. If you believe any provision of this Policy is unclear or incomplete, please contact our DPO — your feedback helps luckypot continuously improve its data governance practices for Filipino players.