luck365 Privacy Policy

1. Who We Are

This Privacy Policy is issued by the legal entity operating the luck365 platform at luck365.asia (hereinafter referred to as "luck365", "we", "us", or "the Company"). luck365 is a licensed online gaming operator holding a valid international gaming authority licence. We are the data controller in respect of the personal data processed under this Privacy Policy.

luck365 is designed and operated for use by adult members located in Malaysia, including Kuala Lumpur, Selangor, Penang, Johor Bahru, and all other states and federal territories. Our platform and this Privacy Policy are written in English, which is the governing language version.

2. Scope of This Policy

This Privacy Policy applies to all personal data collected, processed, stored, and shared by luck365 in connection with:

• Registration and maintenance of a luck365 account;
• Use of any feature of the luck365 Platform, including casino games, sportsbook, slot games, and live dealer services;
• Financial transactions conducted through luck365, including deposits and withdrawals via Touch 'n Go eWallet, Boost, DuitNow, FPX, GrabPay, and Malaysian bank transfer services;
• Communications between a Member and luck365, including live chat, email support, and promotional communications;
• Visits to the luck365.asia website and mobile application, whether or not a luck365 account exists.

This Policy does not apply to third-party websites, services, or applications that may be linked from the luck365 Platform. luck365 has no control over and accepts no responsibility for the privacy practices of third-party operators.

3. Data We Collect

3.1 Registration & Identity Data

When creating a luck365 account, we collect: full legal name, date of birth, gender, Malaysian identity document number (MyKad or passport number), residential address, email address, and mobile phone number. This data is collected to create and manage your account and to fulfil our KYC obligations under international gaming authority licence requirements.

3.2 Identity Verification (KYC) Documents

To comply with our licence conditions and anti-money laundering obligations, luck365 collects copies of government-issued photo identity documents (MyKad or passport) and proof-of-address documents (utility bill or bank statement dated within 90 days). These documents are stored in encrypted form and accessible only to authorised compliance personnel.

3.3 Financial Transaction Data

luck365 collects records of all deposits, withdrawals, bet placements, game results, and bonus transactions associated with a Member's account. This includes payment method identifiers (e-wallet account references, bank account numbers), transaction amounts in MYR, and transaction timestamps. Full payment card numbers are never stored by luck365.

3.4 Platform Usage Data

We collect information about how Members interact with the luck365 Platform, including: games played, betting history, session duration, login timestamps, device type, operating system, browser type, IP address, and approximate geographic location derived from IP. This data is used for service improvement, responsible gaming monitoring, and fraud detection.

3.5 Communications Data

Records of communications between Members and luck365 — including live chat transcripts, email correspondence, and support ticket content — are retained for quality assurance, dispute resolution, and regulatory compliance purposes.

4. How We Use Your Data

luck365 uses the personal data we collect for the following purposes:

• Account management: Creating, maintaining, and securing your luck365 account, processing the luck365 Login, and enabling access to all platform features;
• Identity and age verification: Confirming that Members are aged 21 or above and are who they claim to be, in accordance with licensing obligations;
• Payment processing: Processing MYR deposits and withdrawals via Touch 'n Go eWallet, Boost, DuitNow, FPX, and other accepted Malaysian payment methods;
• Regulatory compliance: Meeting our obligations under our international gaming authority licence, including AML reporting, responsible gaming monitoring, and record-keeping requirements;
• Fraud and security: Detecting, investigating, and preventing fraudulent activity, unauthorised account access, and abuse of promotional offers;
• Responsible gaming: Monitoring account activity for indicators of problem gambling behaviour and administering deposit limits, cooling-off periods, and self-exclusion requests;
• Service improvement: Analysing aggregated platform usage data to improve game selection, platform performance, and user experience;
• Customer support: Responding to enquiries, resolving disputes, and maintaining records of Member communications;
• Marketing communications: Sending promotional emails and in-platform notifications about luck365 offers, subject to a Member's communication preferences. Members may opt out of marketing communications at any time from account settings.

5. Legal Basis for Processing

luck365 processes personal data on the following legal bases:

• Contract performance: Processing necessary to provide the luck365 service under the Member Account Agreement, including account management, payment processing, and game access;
• Legal obligation: Processing required to comply with our international gaming authority licence conditions, AML obligations, age verification requirements, and applicable data protection law;
• Legitimate interests: Processing for fraud detection, platform security, responsible gaming monitoring, and service analytics — where our legitimate interests do not override Member privacy rights;
• Consent: Marketing communications, where we rely on an active opt-in from the Member. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

6. Data Sharing & Disclosure

luck365 does not sell, rent, or trade Member personal data. We share personal data only in the following circumstances and only to the extent necessary:

6.1 Service Providers

luck365 engages third-party service providers to support platform operations, including payment gateway operators (for processing Touch 'n Go, DuitNow, FPX, and other Malaysian payment transactions), identity verification providers, cloud hosting and infrastructure providers, customer support software providers, and game content licensors. All service providers are contractually bound to process Member data only on luck365's instructions and to maintain appropriate security standards.

6.2 Regulatory Authorities

luck365 is required by its international gaming authority licence to disclose Member data to licensing and regulatory authorities upon request or as required by applicable law. This includes AML disclosures to relevant financial intelligence units where legally required.

6.3 Legal Requirements

luck365 may disclose Member data where required to do so by applicable law, court order, or government directive, or where necessary to protect the rights, property, or safety of luck365, its Members, or third parties.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of luck365's business, Member personal data may be transferred to the acquiring entity as part of the transaction, subject to equivalent privacy protections being maintained.

7. International Data Transfers

luck365 operates and stores data within secure data centres. Some of our service providers may process data in jurisdictions outside Malaysia. Where personal data is transferred internationally, luck365 ensures that appropriate safeguards are in place — including contractual clauses based on internationally recognised model contract provisions — to ensure that the level of data protection afforded to Malaysian Members is maintained.

Members who wish to obtain further information about international transfer safeguards may contact luck365 via live chat or at the email address specified in Section 15 of this Policy.

8. Data Retention

luck365 retains personal data for as long as is necessary to fulfil the purposes described in this Privacy Policy, subject to the following minimum retention periods required by our licensing obligations:

• Account and identity data: Retained for a minimum of 5 years following account closure, in accordance with international gaming authority AML record-keeping requirements;
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction;
• KYC documentation: Retained for a minimum of 5 years following the end of the business relationship;
• Platform usage and session data: Retained for up to 2 years for analytics and responsible gaming purposes;
• Communications records: Retained for up to 3 years for dispute resolution and quality assurance purposes.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with luck365's data destruction procedures.

9. Cookies & Tracking Technologies

The luck365 Platform uses cookies and similar tracking technologies to support platform functionality, improve user experience, and analyse platform usage. The following categories of cookies are used:

• Strictly necessary cookies: Required for the Platform to function, including session authentication, luck365 Login state management, and security features. These cannot be disabled without impacting Platform functionality;
• Functional cookies: Remember Member preferences such as language settings and game layout choices;
• Analytics cookies: Collect aggregated, anonymised data about how Members use the Platform, used to improve performance and game selection;
• Security cookies: Support fraud detection and account security monitoring.

luck365 does not use third-party advertising cookies. Members can manage cookie preferences through their browser settings. Disabling strictly necessary cookies will affect the ability to log in and use the Platform.

10. Your Privacy Rights

Subject to applicable law and the requirements of our licensing obligations, Members have the following rights in respect of their personal data held by luck365:

• Right of access: The right to request a copy of the personal data luck365 holds about you;
• Right to rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to erasure: The right to request deletion of your personal data in certain circumstances, subject to overriding legal and regulatory retention obligations;
• Right to restrict processing: The right to request that luck365 restricts processing of your data in certain circumstances;
• Right to data portability: The right to receive your personal data in a structured, commonly used format in certain circumstances;
• Right to withdraw consent: Where processing is based on consent (e.g., marketing communications), the right to withdraw consent at any time from Account Settings or by contacting support.

To exercise any of the above rights, contact luck365 using the details in Section 15. luck365 will respond within 30 days of receiving a verifiable request. In some cases, we may need to verify your identity before fulfilling a request.

11. Children's Privacy

The luck365 Platform is strictly for adults aged 21 and above. luck365 does not knowingly collect personal data from individuals under the age of 21. All registration attempts are subject to age verification, and any account found to belong to an underage individual will be suspended immediately, with personal data processed only to the extent required to fulfil our regulatory reporting obligations in connection with the underage access incident.

Parents or guardians who believe that a person under 21 has created a luck365 account should contact our support team immediately via live chat.

12. Security Measures

luck365 implements a comprehensive set of technical and organisational security measures to protect Member personal data, including:

• 256-bit SSL/TLS encryption on all data transmitted between Members and the luck365 Platform;
• Encryption at rest for all stored personal data and financial records;
• Role-based access controls ensuring that luck365 personnel can only access Member data necessary for their specific function;
• Multi-factor authentication for all internal system access by luck365 staff;
• Regular independent security audits and penetration testing;
• Incident response procedures and breach notification processes aligned with our licensing obligations.

Members are responsible for maintaining the security of their luck365 Login credentials. luck365 recommends enabling two-factor authentication (2FA) for all accounts, available from Account Settings.

13. Third-Party Links

The luck365 Platform may contain links to third-party websites or services, including game content providers. luck365 has no control over the content, privacy practices, or data collection activities of third-party operators and is not responsible for their privacy policies. Members should review the privacy policies of any third-party service they choose to access.

14. Changes to This Privacy Policy

luck365 reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or the services we provide. The "Last updated" date at the top of this page will be revised accordingly. Where a proposed change materially affects Member rights, luck365 will provide at least 14 days' advance notice via the email address registered to the Member's Account. Continued use of the luck365 Platform following the effective date of any change constitutes acceptance of the updated Privacy Policy.

15. Contact & Data Subject Requests

For any questions, concerns, or requests relating to this Privacy Policy or luck365's data practices, Members may contact us through the following channels:

• Live Chat: Available on every page of the luck365 Platform, 24 hours a day, 7 days a week — including Malaysian public holidays such as Hari Raya, Chinese New Year, and Deepavali;
• Email: [email protected] — for data subject access requests and privacy enquiries, please include "Privacy Request" in the subject line.

luck365 aims to acknowledge privacy requests within 5 working days and to complete them within 30 calendar days. Complex requests may require additional time, in which case we will inform the Member of the extended timeline and reason for the delay.