Your Privacy Matters at luck21

luck21 is an online casino and sports betting platform operating at https://luck21.net, serving players across Pakistan including Karachi, Lahore, Islamabad, Faisalabad, and other cities. luck21 operates under an internationally regulated gaming licence framework.

For the purposes of this Privacy Policy, luck21 acts as the data controller — meaning we determine the purposes and means by which your personal data is processed. Where luck21 engages third-party service providers to process data on our behalf, those parties act as data processors and are bound by written data processing agreements that require them to handle your data only on luck21's instructions and in accordance with applicable data protection law.

luck21 collects the following categories of personal data, depending on how you interact with the Platform:

Identity & Registration Data

• Full legal name, date of birth, and gender;
• Pakistani CNIC number or valid passport number (for KYC verification);
• Profile username and account password (stored in hashed format — never in plain text);
• Scanned or photographed identity documents submitted during KYC.

Contact Data

• Email address (used for account notifications, support, and where consented, marketing);
• Pakistani mobile phone number (used for SMS verification and two-factor authentication);
• Residential city and province (used for localisation and responsible gaming regional compliance).

Financial Data

• JazzCash or EasyPaisa account number associated with your transactions;
• Bank account details where bank transfer methods (HBL, UBL, Meezan Bank, 1LINK) are used;
• Deposit and withdrawal transaction history, amounts, and timestamps;
• Source-of-funds documentation where requested under AML compliance obligations.

Gaming & Betting Activity Data

• Game session records including game type, stakes, outcomes, and session duration;
• Sports betting market selections, stake amounts, and bet settlement records;
• Bonus and promotion usage history;
• Responsible gaming tool settings, including deposit limits, cooling-off periods, and self-exclusion status.

Technical & Device Data

• IP address and approximate geolocation derived from IP;
• Device type, operating system, and browser version;
• Session timestamps, pages visited, and time spent on each page;
• Cookie identifiers and similar tracking technologies (see Section 7).

luck21 collects personal data through the following channels:

luck21 uses the personal data we hold about you for the following purposes. Each purpose is linked to a lawful basis described in Section 5.

luck21 processes your personal data only where a lawful basis exists. We rely on the following legal bases:

luck21 does not sell your personal data. We share your data only in the following limited and controlled circumstances:

Payment Processors

To facilitate deposits and withdrawals, luck21 shares the minimum necessary payment and identity data with JazzCash, EasyPaisa, Raast, 1LINK, HBL, UBL, Meezan Bank, and Cash OTC processors. These parties process data solely for the purpose of executing the requested transaction and are bound by their own regulatory obligations as licensed financial services providers.

Identity Verification & KYC Providers

luck21 engages licensed third-party identity verification services to process the KYC documents you submit. These providers verify your identity on our behalf and return a verification outcome. They are contractually prohibited from retaining or using your data for any other purpose.

Fraud Prevention & Security Partners

luck21 shares technical and device data with security and fraud detection partners for the purpose of identifying and preventing fraudulent activity on the Platform. This sharing is carried out under data processing agreements that restrict use to fraud prevention only.

Regulatory and Law Enforcement Authorities

luck21 is obligated to disclose personal data to gaming regulators, financial intelligence units, law enforcement agencies, or courts where required by applicable law, a court order, or a regulatory direction. We do not volunteer information beyond what is legally required.

Gaming Licence Regulatory Body

As a condition of our international gaming licence, luck21 may be required to provide player account data, transaction records, and responsible gaming information to our licensing authority on request or as part of routine regulatory audit procedures.

luck21 uses cookies and similar tracking technologies on the Platform. A cookie is a small text file placed on your device by a website to remember information about your visit. Below is a summary of the cookies luck21 uses:

You can manage cookie preferences through your browser settings at any time. Please note that disabling strictly necessary cookies will prevent you from logging in or using core Platform features. Disabling analytics cookies will not affect your ability to play or transact on luck21.

luck21 implements comprehensive technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security programme includes:

• TLS/SSL Encryption: All data in transit between your device and luck21's servers is encrypted using TLS 1.2 or higher;
• AES-256 Encryption at Rest: Sensitive data stored in our databases — including identity documents, payment details, and account credentials — is encrypted using AES-256 standard encryption;
• Password Hashing: Account passwords are never stored in plain text. We use bcrypt hashing with salting to ensure passwords cannot be recovered even in the event of a data breach;
• Two-Factor Authentication: Players are encouraged to enable two-factor authentication (2FA) via their Account settings for an additional layer of login security;
• Access Controls: Access to personal data within luck21's systems is restricted to authorised personnel only, on a strict need-to-know basis, with all access logged and auditable;
• Regular Security Audits: luck21's infrastructure is subject to regular penetration testing and security reviews by independent third-party security specialists;
• Incident Response: luck21 maintains a formal data breach response plan. In the event of a breach affecting your personal data, we will notify affected players and relevant authorities within the timeframes required by applicable law.

luck21 retains personal data only for as long as necessary to fulfil the purpose for which it was collected, comply with legal obligations, and resolve any disputes or enforce agreements. The following retention periods apply:

Upon expiry of the applicable retention period, luck21 will securely delete or anonymise your personal data in a manner that makes recovery impossible. Deletion requests submitted by players (see Section 12) will be processed subject to any overriding legal retention obligations — we cannot delete data we are legally required to retain, but we will confirm exactly what data is subject to a mandatory hold and the expected deletion date.

luck21 operates under an international gaming licence framework, and some of our service providers and infrastructure partners are based outside Pakistan. As a result, your personal data may be transferred to and processed in countries other than Pakistan, including countries within the European Economic Area (EEA) and other jurisdictions.

Where personal data is transferred outside Pakistan, luck21 ensures that appropriate safeguards are in place to protect your data. These safeguards include:

• Transfers to countries that have been assessed as providing an adequate level of data protection;
• Standard contractual clauses approved by relevant data protection authorities, incorporated into agreements with receiving parties;
• Binding corporate rules where data is shared within a corporate group operating under a unified data protection framework;
• Contractual requirements that receiving parties implement security measures equivalent to those required under luck21's internal data protection standards.

luck21 is strictly an adult-only platform. Our services are available exclusively to persons aged 21 years or older. We do not knowingly collect, process, or store personal data belonging to individuals under the age of 21.

As part of our registration and KYC process, luck21 verifies the age of all players before allowing account activation or any real-money transactions. Identity documents submitted during KYC are reviewed to confirm that the applicant meets the minimum age requirement.

Parents and guardians are encouraged to use internet filtering and parental control tools to prevent minors from accessing online gambling platforms. luck21 supports national responsible gaming initiatives and will cooperate with any regulatory authority investigating underage access.

luck21 respects and upholds your rights in relation to your personal data. Depending on your jurisdiction, you may be entitled to exercise all or some of the following rights:

• Right of Access: You have the right to request a copy of the personal data luck21 holds about you, along with information about how it is processed.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: You have the right to request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you have withdrawn consent, or where processing was unlawful. This right is subject to mandatory legal retention obligations.
• Right to Restrict Processing: You have the right to request that luck21 restricts the processing of your data in certain circumstances — for example, while a rectification request is under review.
• Right to Data Portability: Where processing is based on contract performance or consent, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object: You have the right to object to processing based on legitimate interests at any time on grounds relating to your particular situation. You also have an absolute right to object to processing for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, submit a written request to [email protected] with the subject line "Data Rights Request". Please include your Account username and a description of the right you wish to exercise. luck21 will respond within 30 days. For complex or multiple requests, we may extend this period by a further 60 days, in which case we will notify you of the extension and the reason for it.

luck21 sends marketing communications — including promotional offers, bonus notifications, PSL betting tips, new game announcements, and seasonal campaigns — only to players who have provided explicit opt-in consent to receive such communications.

You may opt in to marketing communications during the account registration process or at any time through your Account Settings. luck21 may send marketing communications via the following channels where consented:

• Email to your registered email address;
• SMS to your registered Pakistani mobile number;
• In-platform notifications within the luck21 Platform when you are logged in.

Opting Out: You can withdraw your marketing consent and opt out of all promotional communications at any time using any of the following methods:

• Click the "Unsubscribe" link included in the footer of any marketing email from luck21;
• Reply "STOP" to any marketing SMS from luck21;
• Update your communication preferences in your Account Settings under "Notifications & Marketing";
• Contact luck21 support at [email protected] with the subject line "Marketing Opt-Out".

luck21 may update this Privacy Policy from time to time to reflect changes in our data processing practices, regulatory requirements, or the expansion of Platform services. When we make material changes to this Privacy Policy, we will take the following steps to ensure you are informed:

• Update the "Last Updated" date at the top of this page;
• Display a prominent notice on the luck21 Platform for a period of not less than 30 days following the update;
• Send a notification email to all registered players with an active account, summarising the key changes;
• Where changes are significant and affect the legal basis on which we process your data, seek fresh consent where required.

Your continued use of the luck21 Platform following the effective date of any updated Privacy Policy constitutes your acknowledgement of the updated policy. If you do not agree with any changes made to this Privacy Policy, you should cease using the Platform and contact luck21 support to close your account and exercise any applicable data rights.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or want to raise a privacy concern, please contact the luck21 Data Protection team using the details below:

When contacting luck21 regarding a data rights request, please include your registered Account username and a clear description of the right you wish to exercise or the concern you wish to raise. The more detail you provide, the more efficiently we can assist you.