1.1 Identity. For the purposes of the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, the data controller responsible for your personal information is lucky7, the operator of the online gaming platform accessible at lucky7.today (the "Platform").
1.2 Data Protection Officer. lucky7 has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and applicable data protection laws. You may contact the DPO at the email address provided in Section 12 of this Policy.
1.3 Scope. This Privacy Policy applies to all personal information collected by lucky7 through the Platform, including information collected during account registration, identity verification, gameplay, financial transactions, customer support interactions, and marketing communications. It applies to all registered players and visitors to lucky7.today located in the Philippines.
Note: By registering an account on lucky7 or continuing to use the Platform after the effective date of this Policy, you acknowledge that you have read, understood, and agree to the collection and use of your personal information as described herein.
2.1 Information You Provide Directly. lucky7 collects personal information that you voluntarily provide when you register an account, complete identity verification, make deposits or withdrawals, contact customer support, or participate in promotions. This includes:
- Identity data: Full legal name, date of birth, nationality, and government-issued ID details (e.g., PhilSys National ID, passport, driver's license, SSS/GSIS card number).
- Contact data: Email address, mobile number, and residential address (including city — Manila, Cebu, Davao, Quezon City, Makati, or elsewhere in the Philippines).
- Financial data: GCash account number, PayMaya account details, BPI/BDO/Metrobank account information, deposit and withdrawal history, and transaction amounts in Philippine Peso (PHP).
- Account credentials: Username and encrypted password hash.
- Support communications: Records of live chat, email, and any other correspondence with the lucky7 support team.
2.2 Information Collected Automatically. When you access and use the lucky7 Platform, certain technical data is collected automatically by our systems:
| Data Type |
Examples |
Purpose |
| Device data |
Device type, OS, browser version |
Platform compatibility, fraud detection |
| Log data |
IP address, access timestamps, pages visited |
Security monitoring, regulatory compliance |
| Gameplay data |
Game sessions, bet amounts, win/loss records |
Account management, responsible gaming |
| Location data |
Country/region derived from IP address |
Geo-restriction compliance |
| Cookie data |
Session tokens, preference cookies |
Authentication, user experience |
2.3 Information from Third Parties. lucky7 may receive personal information about you from third-party identity verification providers, payment processors (GCash, PayMaya, BPI, BDO, Metrobank), fraud prevention services, and regulatory bodies such as PAGCOR, where permitted by law.
Sensitive Personal Information: Government-issued ID numbers, financial account details, and biometric data (where collected for identity verification) are classified as sensitive personal information under the Data Privacy Act. lucky7 applies heightened security controls to this category of data.
lucky7 uses your personal information only for the purposes described below. We do not use your data for any purpose incompatible with the reason it was originally collected.
- Account management: Creating, maintaining, and securing your lucky7 player account, including authentication and password recovery.
- Identity verification (KYC): Verifying your identity and age (21+) as required by PAGCOR regulations and anti-money laundering obligations under the AMLA.
- Payment processing: Processing deposits and withdrawals via GCash, PayMaya, BPI, BDO, and Metrobank in Philippine Peso.
- Gameplay and platform operation: Delivering game content, recording game outcomes, managing bonuses, and maintaining platform integrity.
- Responsible gaming: Monitoring gameplay patterns to identify potential problem gambling behavior and enforcing self-exclusion and deposit limit requests.
- Customer support: Responding to your inquiries, resolving disputes, and improving our support services.
- Fraud prevention and security: Detecting, investigating, and preventing fraudulent transactions, money laundering, and other prohibited conduct.
- Legal and regulatory compliance: Meeting our obligations under Philippine law, including reporting to PAGCOR and the AMLC as required.
- Marketing communications: Sending you promotional offers, bonus notifications, and platform updates — only where you have consented or where we have a legitimate interest, and always with an easy opt-out mechanism.
- Platform improvement: Analyzing aggregated, anonymized usage data to improve the lucky7 platform, game selection, and user experience.
No Automated Decision-Making: lucky7 does not make decisions that produce significant legal effects on you solely through automated processing without human review. Account suspension decisions are reviewed by our compliance team before being finalized.
4
Legal Basis for Processing
Under the Philippine Data Privacy Act of 2012, lucky7 processes your personal information on the following legal bases:
- Contractual necessity: Processing required to perform the contract between you and lucky7 — including account creation, payment processing, and gameplay delivery.
- Legal obligation: Processing required to comply with Philippine law, including PAGCOR licensing conditions, AMLA reporting obligations, and National Privacy Commission (NPC) requirements.
- Legitimate interests: Processing necessary for lucky7's legitimate business interests, including fraud prevention, platform security, and service improvement — provided these interests are not overridden by your rights and freedoms.
- Consent: Processing based on your freely given, specific, informed, and unambiguous consent — primarily for marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
5.1 We Do Not Sell Your Data. lucky7 does not sell, rent, or trade your personal information to any third party for commercial purposes. Full stop.
5.2 Service Providers. lucky7 shares personal information with carefully selected third-party service providers who assist in operating the Platform. These providers are contractually bound to process your data only on lucky7's instructions and in accordance with the Data Privacy Act. Categories of service providers include:
- Payment processors: GCash (G-Xchange, Inc.), PayMaya (Maya Bank), BPI, BDO, and Metrobank for transaction processing.
- Identity verification providers: Third-party KYC/AML screening services for age and identity verification.
- Game content providers: Licensed game studios whose titles are available on the lucky7 platform.
- Cloud infrastructure providers: Hosting and data storage services operating under strict data processing agreements.
- Customer support tools: Live chat and ticketing platforms used to manage player support interactions.
5.3 Regulatory Disclosures. lucky7 is legally required to share certain information with Philippine regulatory and law enforcement authorities, including:
- PAGCOR: Player account data, transaction records, and compliance reports as required under lucky7's operating license.
- Anti-Money Laundering Council (AMLC): Suspicious transaction reports (STRs) and covered transaction reports (CTRs) as mandated by the AMLA.
- National Privacy Commission (NPC): Data breach notifications and compliance reports as required by the Data Privacy Act.
- Law enforcement agencies: Information disclosed in response to valid legal process, court orders, or lawful requests from Philippine law enforcement.
Important: Regulatory disclosures are legal obligations. lucky7 cannot withhold information from PAGCOR, the AMLC, or law enforcement when lawfully required to disclose it, regardless of your consent preferences.
5.4 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of lucky7's assets, your personal information may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy practices of the successor entity prior to the transfer taking effect.
6.1 Retention Periods. lucky7 retains your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:
| Data Category |
Retention Period |
Basis |
| Account registration data |
Duration of account + 5 years after closure |
PAGCOR licensing, AMLA |
| Identity verification (KYC) documents |
5 years after account closure |
AMLA Section 9 |
| Financial transaction records |
5 years from transaction date |
AMLA, BIR requirements |
| Gameplay logs |
3 years from session date |
PAGCOR compliance |
| Customer support records |
3 years from last interaction |
Legitimate interests |
| Marketing consent records |
Until consent withdrawn + 1 year |
Data Privacy Act |
6.2 Deletion. Upon expiry of the applicable retention period, lucky7 will securely delete or anonymize your personal information so that it can no longer be associated with you. Anonymized, aggregated data may be retained indefinitely for statistical and analytical purposes.
7.1 Technical Safeguards. lucky7 implements a comprehensive set of technical security measures to protect your personal information against unauthorized access, disclosure, alteration, and destruction:
- TLS 1.3 encryption for all data in transit between your device and lucky7's servers.
- AES-256 encryption for sensitive data stored at rest, including payment details and identity documents.
- Bcrypt password hashing — your password is never stored in plain text.
- Multi-factor authentication (MFA) available for all player accounts.
- Intrusion detection systems (IDS) and 24/7 security monitoring of platform infrastructure.
- Regular penetration testing conducted by independent third-party security firms.
- Web Application Firewall (WAF) to protect against common web-based attacks.
7.2 Organizational Safeguards. Access to personal data within lucky7 is restricted on a strict need-to-know basis. All staff with access to personal data undergo data privacy training and are bound by confidentiality obligations. lucky7 maintains a formal data breach response plan in accordance with NPC requirements.
7.3 Data Breach Notification. In the event of a personal data breach that is likely to result in serious harm to affected individuals, lucky7 will notify the National Privacy Commission (NPC) within 72 hours of becoming aware of the breach, and will notify affected players without undue delay, in accordance with the Data Privacy Act and NPC Circular No. 16-03.
Your Role in Security: While lucky7 takes extensive measures to protect your data, you also play an important role. Use a strong, unique password for your lucky7 account, enable MFA, and never share your login credentials with anyone. lucky7 will never ask for your password.
8
Your Rights Under the Data Privacy Act
As a data subject under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal information held by lucky7:
Right to Be Informed
Know what personal data lucky7 collects about you and how it is used.
Right to Access
Request a copy of the personal data lucky7 holds about you.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your data where no longer necessary or lawfully required.
Right to Object
Object to processing based on legitimate interests, including direct marketing.
Right to Data Portability
Receive your data in a structured, machine-readable format.
Right to Withdraw Consent
Withdraw marketing consent at any time without penalty.
Right to Damages
Claim compensation for damages suffered due to inaccurate or unlawfully processed data.
8.1 How to Exercise Your Rights. To exercise any of the rights listed above, contact lucky7's Data Protection Officer using the contact details in Section 12. lucky7 will respond to your request within fifteen (15) calendar days of receipt. In complex cases, this period may be extended by a further thirty (30) days, with notice provided to you.
8.2 Verification. For security purposes, lucky7 may require you to verify your identity before processing a data rights request. This is to ensure that personal data is not disclosed to unauthorized parties.
8.3 Complaints. If you believe lucky7 has not handled your personal data in accordance with the Data Privacy Act, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.
9.1 What Are Cookies. Cookies are small text files placed on your device when you visit lucky7.today. They help lucky7 recognize your device, remember your preferences, keep you logged in, and understand how you use the Platform.
9.2 Types of Cookies Used by lucky7.
| Cookie Type |
Purpose |
Duration |
| Strictly Necessary |
Session management, authentication, security tokens |
Session / up to 24 hours |
| Functional |
Language preferences, game settings, responsible gaming tool states |
Up to 12 months |
| Analytics |
Aggregated usage statistics to improve platform performance |
Up to 24 months |
| Marketing |
Tracking promotional campaign effectiveness (only with consent) |
Up to 12 months |
9.3 Managing Cookies. You can control and delete cookies through your browser settings. Note that disabling strictly necessary cookies will affect the functionality of the lucky7 Platform, including your ability to log in and play. Marketing cookies can be disabled at any time from your lucky7 account settings without affecting gameplay.
10.1 Age Restriction. The lucky7 Platform is strictly restricted to individuals who are at least twenty-one (21) years of age, in accordance with PAGCOR regulations. lucky7 does not knowingly collect personal information from individuals under the age of 21.
10.2 Discovery of Minor's Data. If lucky7 discovers or is notified that personal information has been collected from an individual under 21 years of age, lucky7 will immediately close the associated account, delete all personal data collected from that individual, and void any transactions or winnings associated with the account.
Parents and Guardians: If you believe a minor in your household has registered on lucky7, please contact our support team immediately. We take underage gambling extremely seriously and will act swiftly to close any such account. We also encourage the use of parental control software to prevent minors from accessing online gambling platforms.
11.1 Right to Update. lucky7 reserves the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable Philippine law, or regulatory requirements. The "Last Updated" date at the top of this Policy will be revised accordingly.
11.2 Notification of Material Changes. Where changes to this Privacy Policy are material — meaning they significantly affect how we collect, use, or share your personal information — lucky7 will notify registered players via email or an in-platform notification at least fourteen (14) days before the changes take effect.
11.3 Continued Use. Your continued use of the lucky7 Platform after the effective date of any updated Privacy Policy constitutes your acknowledgment of the changes. If you do not agree with the updated Policy, you may close your account in accordance with the Terms and Conditions.
12.1 Data Protection Officer. For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by lucky7, please contact our Data Protection Officer:
lucky7 Data Protection Officer
Website: lucky7.today
Email: privacy@lucky7.today
Support: Available 24/7 via live chat from your lucky7 account dashboard
Response time: Within 15 calendar days of receipt of your request
12.2 National Privacy Commission. If you are not satisfied with lucky7's response to your data privacy concern, you have the right to file a complaint with the National Privacy Commission of the Philippines:
National Privacy Commission (NPC)
3rd Floor, Core G, DICT Building, C.P. Garcia Ave., Diliman, Quezon City
Website: privacy.gov.ph (for reference only — not a lucky7 link)