Privacy Policy — luck38 Online Casino & Sportsbook

Who We Are

luck38 is an online casino and sports betting platform operating at luck38.net. For the purposes of this Privacy Policy, luck38 acts as the data controller in respect of personal data collected from Players and website visitors through the luck38 platform. References to "luck38", "we", "us", or "our" throughout this document refer to the luck38 platform and its operating entity.

luck38 is committed to handling personal data responsibly, transparently, and in compliance with applicable data protection and privacy standards. If you have any questions about how your data is handled, you can contact the luck38 support team at any time using the contact details provided at the end of this policy.

Personal Data We Collect

luck38 collects personal data in the following categories, depending on how you interact with the platform:

2.1 Registration Data

When you create a luck38 account, we collect:

• Full legal name as it appears on your government-issued identification document
• Date of birth (for 21+ age verification purposes)
• Email address
• Mobile phone number
• Residential address
• Preferred username and encrypted password
• Preferred currency (PKR) and language preference

2.2 Identity Verification (KYC) Data

Prior to processing withdrawals and in compliance with KYC obligations, we collect:

• Copy of a valid Pakistani CNIC (Computerised National Identity Card) or passport
• Proof of address documentation where required (utility bill, bank statement)
• Source of funds documentation where required for enhanced due diligence

2.3 Financial Transaction Data

• Deposit and withdrawal transaction records, including amounts, timestamps, and payment method references (JazzCash account identifiers, EasyPaisa wallet numbers, bank account details, USDT wallet addresses)
• Transaction history maintained for AML compliance and dispute resolution purposes

2.4 Usage & Activity Data

• Gaming and betting activity — games played, stakes placed, outcomes, session durations
• Login and session history including timestamps and IP addresses
• Device information: device type, operating system, browser type and version
• Geolocation data (country/region level, derived from IP address)
• Customer support correspondence and chat logs

2.5 Cookie & Technical Data

When you visit luck38.net, we automatically collect certain technical data via cookies and similar tracking technologies. This is detailed further in Section 6 of this policy.

How We Use Your Personal Data

luck38 uses the personal data it collects for the following specific purposes:

• Account creation and management: To register your luck38 account, verify your identity, manage your account settings, and provide access to the platform's services.
• Payment processing: To process deposits and withdrawals via JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and USDT, and to maintain accurate financial records.
• Age and identity verification: To confirm that you meet the 21+ age requirement and to satisfy KYC obligations prior to withdrawal processing.
• Regulatory compliance: To fulfil AML screening obligations, sanctions list checks, and reporting requirements under applicable licensing conditions.
• Responsible gaming: To monitor gaming activity for patterns indicative of problem gambling, to apply player-set limits, and to administer self-exclusion requests.
• Fraud prevention and security: To detect and prevent fraudulent activity, account takeover attempts, bonus abuse, and other prohibited conduct.
• Customer support: To respond to queries, resolve complaints, and provide account assistance.
• Platform improvement: To analyse usage patterns, improve product features, and optimise the luck38 experience for Pakistani players.
• Marketing communications: To send promotional offers, PSL betting notifications, bonus alerts, and platform updates to Players who have consented to receive such communications.

Legal Basis for Processing

luck38 processes personal data under the following legal bases:

• Contractual necessity: Processing required to perform the agreement between you and luck38 — including account registration, payment processing, game provision, and customer support.
• Legal obligation: Processing required to comply with applicable KYC, AML, licensing, and regulatory requirements. This applies to identity verification, transaction monitoring, and regulatory reporting.
• Legitimate interests: Processing conducted for fraud prevention, security monitoring, platform optimisation, and responsible gaming oversight, where these interests are not overridden by your privacy rights.
• Consent: Processing for marketing communications, optional analytics, and non-essential cookies, where your explicit consent has been obtained and can be withdrawn at any time.

Data Sharing & Third-Party Disclosure

luck38 does not sell personal data. Data is shared with third parties only in the following limited and controlled circumstances:

• Payment processors: JazzCash, EasyPaisa, and banking partners (HBL, UBL, Meezan Bank) receive the transaction data necessary to process your deposits and withdrawals. These partners are bound by their own data protection obligations.
• Game software providers: Certified third-party casino game developers whose titles appear in the luck38 lobby may receive anonymised session and wager data for game performance and fairness audit purposes.
• Identity verification services: Third-party KYC and AML screening platforms used to verify identity documents and conduct sanctions screening. These processors are engaged under binding data processing agreements.
• Regulatory and law enforcement authorities: Where required by applicable law, court order, or regulatory direction, luck38 will disclose personal data to competent authorities. luck38 will notify affected Players where legally permitted to do so.
• Customer support platforms: Support ticket and live chat tools used to manage player queries. These platforms process support correspondence data on behalf of luck38 under strict data processing terms.
• Corporate successors: In the event of a merger, acquisition, or asset sale involving the luck38 platform, personal data may be transferred as part of that transaction. Players will be notified of any such transfer and of any changes to this Privacy Policy that result from it.

Cookies & Tracking Technologies

luck38 uses cookies and similar technologies on luck38.net for the following purposes:

• Strictly necessary cookies: Required for the platform to function. These include session authentication tokens, security cookies, and load-balancing identifiers. These cannot be disabled without affecting platform functionality.
• Functional cookies: Used to remember your preferences such as language settings, currency display, and interface customisations between sessions.
• Analytical cookies: Used to understand how Players interact with the luck38 platform — which sections are visited, how long sessions last, and where navigation issues occur. This data is used to improve the platform experience.
• Marketing cookies: Where you have consented, these cookies are used to personalise the promotional content and offers displayed to you based on your activity on the luck38 platform.

You can manage your cookie preferences through your browser settings or through the luck38 cookie preference centre. Withdrawing consent for non-essential cookies will not affect your access to core platform features.

Data Retention

luck38 retains personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following retention standards:

• Active accounts: All personal data associated with an active luck38 account is retained for the duration of the account's active status.
• Closed accounts: Following account closure, personal data is retained for a minimum period of five (5) years to satisfy AML regulatory obligations, resolve any outstanding disputes, and respond to regulatory enquiries.
• KYC documents: Identity verification documents are retained for the period required by applicable licensing and AML regulations, which is generally a minimum of five years from the date of account closure.
• Transaction records: Financial transaction data is retained for at least five years following the transaction date for AML and audit purposes.
• Marketing data: Where consent is the basis for marketing communications, data is retained until consent is withdrawn. Withdrawal of marketing consent does not affect the retention of other data categories required for regulatory compliance.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with luck38's internal data disposal procedures.

Data Security

luck38 implements a layered security architecture to protect personal data against unauthorised access, disclosure, alteration, and destruction:

• Encryption in transit: All data transmitted between users and luck38 servers is protected using TLS 1.2 or higher. Plain HTTP connections are not accepted.
• Encryption at rest: Sensitive personal data — including KYC documents, payment references, and account credentials — is stored using AES-256 encryption or equivalent standards.
• Access controls: Access to personal data within luck38's internal systems is restricted on a need-to-know basis. Staff with access to personal data are subject to confidentiality obligations.
• Two-factor authentication: Available to all luck38 account holders and strongly recommended. Internal administrative access to player data requires multi-factor authentication.
• Intrusion detection: luck38 operates automated monitoring for anomalous access patterns and attempted breaches. Security events are logged and reviewed by the platform security team.
• Incident response: In the event of a data security incident that poses a risk to Players, luck38 will notify affected individuals and relevant authorities in a timely manner in accordance with applicable notification obligations.

Your Data Rights

As a luck38 account holder or website visitor, you have the following rights in relation to your personal data:

To exercise any of the above rights, please contact the luck38 support team. We will respond to all requests within 30 days. Where requests are complex or numerous, we may extend this period by a further 30 days with prior notification.

Children & Minors

luck38 is strictly an adult platform. Access is prohibited to individuals under 21 years of age. luck38 does not knowingly collect or process personal data from individuals under the age of 21. If luck38 discovers that personal data has been collected from a minor, that data will be deleted immediately and the associated account permanently closed.

If you are a parent or guardian and believe that a minor has registered an account on luck38 or provided personal data to the platform, please contact the support team immediately so that appropriate action can be taken.

International Data Transfers

luck38 operates using cloud infrastructure and third-party service providers whose servers may be located outside Pakistan. Where personal data is transferred internationally as part of luck38's operations — for example, to payment processors, game providers, or hosting infrastructure — such transfers are conducted under appropriate safeguards including contractual data protection terms between luck38 and the relevant third-party processors.

luck38 does not transfer personal data to countries or organisations that do not provide an adequate level of data protection without ensuring that appropriate protective measures are in place.

Third-Party Services & Links

The luck38 platform integrates with third-party services for payment processing, game delivery, and customer support. These third parties operate under their own privacy policies and data handling practices. luck38 is not responsible for the privacy practices of third-party services accessed through or in connection with the platform.

luck38.net does not contain links to external third-party websites that are outside luck38's control for the purpose of protecting users from inadvertent data disclosure to unknown third parties.

Marketing Communications

Where you have provided consent, luck38 may contact you with promotional communications including:

• Welcome bonus offers and ongoing promotional campaigns
• PSL match-day betting promotions and cricket tournament special offers
• New game launches and casino product updates
• VIP programme tier updates and exclusive member offers
• Platform feature announcements and scheduled maintenance notifications

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in your luck38 account settings
• Contacting the luck38 support team with an opt-out request

Withdrawal of marketing consent does not affect the legal validity of any processing carried out prior to withdrawal, and does not affect your access to the luck38 platform or any of its features.

Amendments to This Policy

luck38 reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, legal obligations, or platform operations. Material changes to this policy will be communicated to registered Players via email to their registered address and/or via a notice displayed on the luck38 platform prior to the changes taking effect.

We encourage you to review this Privacy Policy periodically. The "Last updated" date at the top of this document indicates when the most recent revision was made. Continued use of the luck38 platform following notification of any amendment constitutes acceptance of the revised Privacy Policy.

Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a concern about how luck38 handles your personal data, please contact the support team:

Support email:  [email protected]

The luck38 support team is available 24/7 in both English and Urdu. Privacy-related queries will be handled by the appropriate team and responded to within 30 days. Please include "Privacy Request" or "Data Rights" in your query subject line for fastest routing.

If you are not satisfied with luck38's response to a privacy complaint, you may have the right to escalate your complaint to the relevant data protection or gaming regulatory authority applicable under luck38's operating licence.