lucky7 Privacy Policy

1.1 Identity. For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, the data controller responsible for your personal information is lucky7, the operator of the online gaming platform accessible at lucky7.today (the "Platform").

1.2 Data Protection Officer. lucky7 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection laws. You may contact the DPO at the email address provided in Section 12 of this Policy.

1.3 Scope. This Privacy Policy applies to all personal information collected by lucky7 through the Platform, including information collected during account registration, identity verification, gameplay, financial transactions, customer support interactions, and marketing communications. It applies to all registered players and visitors to lucky7.today located in the Philippines.

2.1 Information You Provide Directly. lucky7 collects personal information that you voluntarily provide when you register an account, complete identity verification, make deposits or withdrawals, contact customer support, or participate in promotions. This includes:

• Identity data: Full legal name, date of birth, nationality, and government-issued ID details (e.g., PhilSys National ID, passport, driver's license, SSS/GSIS card number).
• Contact data: Email address, mobile number, and residential address (including city — Manila, Cebu, Davao, Quezon City, Makati, or elsewhere in the Philippines).
• Financial data: GCash account number, PayMaya account details, BPI/BDO/Metrobank account information, deposit and withdrawal history, and transaction amounts in Philippine Peso (PHP).
• Account credentials: Username and encrypted password hash.
• Support communications: Records of live chat, email, and any other correspondence with the lucky7 support team.

2.2 Information Collected Automatically. When you access and use the lucky7 Platform, certain technical data is collected automatically by our systems:

2.3 Information from Third Parties. lucky7 may receive personal information about you from third-party identity verification providers, payment processors (GCash, PayMaya, BPI, BDO, Metrobank), fraud prevention services, and regulatory bodies such as PAGCOR, where permitted by law.

lucky7 uses your personal information only for the purposes described below. We do not use your data for any purpose incompatible with the reason it was originally collected.

• Account management: Creating, maintaining, and securing your lucky7 player account, including authentication and password recovery.
• Identity verification (KYC): Verifying your identity and age (21+) as required by PAGCOR regulations and anti-money laundering obligations under the AMLA.
• Payment processing: Processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank in Philippine Peso.
• Gameplay and platform operation: Delivering game content, recording game outcomes, managing bonuses, and maintaining platform integrity.
• Responsible gaming: Monitoring gameplay patterns to identify potential problem gambling behavior and enforcing self-exclusion and deposit limit requests.
• Customer support: Responding to your inquiries, resolving disputes, and improving our support services.
• Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, money laundering, and other prohibited conduct.
• Legal and regulatory compliance: Meeting our obligations under Philippine law, including reporting to PAGCOR and the AMLC as required.
• Marketing communications: Sending you promotional offers, bonus notifications, and platform updates — only where you have consented or where we have a legitimate interest, and always with an easy opt-out mechanism.
• Platform improvement: Analyzing aggregated, anonymized usage data to improve the lucky7 platform, game selection, and user experience.

Under the Philippine Data Privacy Act of 2012, lucky7 processes your personal information on the following legal bases:

• Contractual necessity: Processing required to perform the contract between you and lucky7 — including account creation, payment processing, and gameplay delivery.
• Legal obligation: Processing required to comply with Philippine law, including PAGCOR licensing conditions, AMLA reporting obligations, and National Privacy Commission (NPC) requirements.
• Legitimate interests: Processing necessary for lucky7's legitimate business interests, including fraud prevention, platform security, and service improvement — provided these interests are not overridden by your rights and freedoms.
• Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5.1 We Do Not Sell Your Data. lucky7 does not sell, rent, or trade your personal information to any third party for commercial purposes. Full stop.

5.2 Service Providers. lucky7 shares personal information with carefully selected third-party service providers who assist in operating the Platform. These providers are contractually bound to process your data only on lucky7's instructions and in accordance with the Data Privacy Act. Categories of service providers include:

• Payment processors: GCash (G-Xchange, Inc.), PayMaya (Maya Bank), BPI, BDO, and Metrobank for transaction processing.
• Identity verification providers: Third-party KYC/AML screening services for age and identity verification.
• Game content providers: Licensed game studios whose titles are available on the lucky7 platform.
• Cloud infrastructure providers: Hosting and data storage services operating under strict data processing agreements.
• Customer support tools: Live chat and ticketing platforms used to manage player support interactions.

5.3 Regulatory Disclosures. lucky7 is legally required to share certain information with Philippine regulatory and law enforcement authorities, including:

• PAGCOR: Player account data, transaction records, and compliance reports as required under lucky7's operating license.
• Anti-Money Laundering Council (AMLC): Suspicious transaction reports (STRs) and covered transaction reports (CTRs) as mandated by the AMLA.
• National Privacy Commission (NPC): Data breach notifications and compliance reports as required by the Data Privacy Act.
• Law enforcement agencies: Information disclosed in response to valid legal process, court orders, or lawful requests from Philippine law enforcement.

5.4 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of lucky7's assets, your personal information may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy practices of the successor entity prior to the transfer taking effect.

6.1 Retention Periods. lucky7 retains your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

6.2 Deletion. Upon expiry of the applicable retention period, lucky7 will securely delete or anonymize your personal information so that it can no longer be associated with you. Anonymized, aggregated data may be retained indefinitely for statistical and analytical purposes.

7.1 Technical Safeguards. lucky7 implements a comprehensive set of technical security measures to protect your personal information against unauthorized access, disclosure, alteration, and destruction:

• TLS 1.3 encryption for all data in transit between your device and lucky7's servers.
• AES-256 encryption for sensitive data stored at rest, including payment details and identity documents.
• Bcrypt password hashing — your password is never stored in plain text.
• Multi-factor authentication (MFA) available for all player accounts.
• Intrusion detection systems (IDS) and 24/7 security monitoring of platform infrastructure.
• Regular penetration testing conducted by independent third-party security firms.
• Web Application Firewall (WAF) to protect against common web-based attacks.

7.2 Organizational Safeguards. Access to personal data within lucky7 is restricted on a strict need-to-know basis. All staff with access to personal data undergo data privacy training and are bound by confidentiality obligations. lucky7 maintains a formal data breach response plan in accordance with NPC requirements.

7.3 Data Breach Notification. In the event of a personal data breach that is likely to result in serious harm to affected individuals, lucky7 will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with the Data Privacy Act and NPC Circular No. 16-03.

As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal information held by lucky7:

8.1 How to Exercise Your Rights. To exercise any of the rights listed above, contact lucky7's Data Protection Officer using the contact details in Section 12. lucky7 will respond to your request within fifteen (15) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days, with notice provided to you.

8.2 Verification. For security purposes, lucky7 may require you to verify your identity before processing a data rights request. This is to ensure that personal data is not disclosed to unauthorized parties.

8.3 Complaints. If you believe lucky7 has not handled your personal data in accordance with the Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

9.1 What Are Cookies. Cookies are small text files placed on your device when you visit lucky7.today. They help lucky7 recognize your device, remember your preferences, keep you logged in, and understand how you use the Platform.

9.2 Types of Cookies Used by lucky7.

9.3 Managing Cookies. You can control and delete cookies through your browser settings. Note that disabling strictly necessary cookies will affect the functionality of the lucky7 Platform, including your ability to log in and play. Marketing cookies can be disabled at any time from your lucky7 account settings without affecting gameplay.

10.1 Age Restriction. The lucky7 Platform is strictly restricted to individuals who are at least twenty-one (21) years of age, in accordance with PAGCOR regulations. lucky7 does not knowingly collect personal information from individuals under the age of 21.

10.2 Discovery of Minor's Data. If lucky7 discovers or is notified that personal information has been collected from an individual under 21 years of age, lucky7 will immediately close the associated account, delete all personal data collected from that individual, and void any transactions or winnings associated with the account.

11.1 Right to Update. lucky7 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable Philippine law, or regulatory requirements. The "Last Updated" date at the top of this Policy will be revised accordingly.

11.2 Notification of Material Changes. Where changes to this Privacy Policy are material — meaning they significantly affect how we collect, use, or share your personal information — lucky7 will notify registered players via email or an in-platform notification at least fourteen (14) days before the changes take effect.

11.3 Continued Use. Your continued use of the lucky7 Platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with the updated Policy, you may close your account in accordance with the Terms and Conditions.

12.1 Data Protection Officer. For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by lucky7, please contact our Data Protection Officer:

12.2 National Privacy Commission. If you are not satisfied with lucky7's response to your data privacy concern, you have the right to file a complaint with the National Privacy Commission of the Philippines: