Privacy Policy luck3 – Data Protection Users

01Introduction & Scope of This Policy

This Privacy Policy is issued by luck3 ("we", "Platform") and applies to all users who access or use the luck3 platform via the website luck3.app or our official mobile app.

This document comprehensively describes our privacy practices — from the types of data we collect and how it is used, to who it may be shared with and your rights as a user. We have written this policy to be clear and accessible to our Malaysian users.

By using the luck3 platform, you agree to the practices described in this Privacy Policy. If you disagree with any part of this policy, we encourage you to contact us before continuing to use the platform.

02Data We Collect

Luck3 only collects data that is strictly necessary to provide services that are safe, fair, and compliant with legal requirements. The following are the categories of data we collect:

A. Data You Provide Directly

• Registration Information: Full name, date of birth, email address, phone number, and encrypted password.
• Identity Verification (KYC): Copy of a national identity card, passport, driving licence, or other government-issued identity document recognised in Malaysia.
• Financial Information: Bank account number, e-wallet details (DuitNow, Touch 'n Go, Boost, GrabPay), and in-platform transaction history.
• Profile Information: Display name, language preference, and account settings you have configured yourself.

B. Data Collected Automatically

• Device Data: Device type, operating system, browser version, screen resolution, and unique device identifier.
• Connection Data: IP address, IP-based geographic location (state and country), internet service provider, and connection time.
• Activity Data: Pages visited, session duration, games played, total wagering amount, and platform usage patterns.
• Cookie Data: Session cookies, preference cookies, and analytics cookies as described in Section 7.

03How We Use Your Data

Every piece of data we collect has a clear and legitimate purpose. We use your data for the following purposes:

• Account Management: Creating and maintaining your account, processing registration, and enabling you to log in securely.
• Identity Verification: Conducting KYC checks to confirm you meet the minimum age requirement (18 years old) and to verify your identity before processing withdrawals.
• Transaction Processing: Processing deposits, withdrawals, and bonus credits to your account accurately and securely.
• Platform Security: Detecting and preventing fraud, money laundering, unauthorized access, and other suspicious activity on the platform.
• Customer Support: Responding to inquiries, resolving complaints, and providing technical support when needed.
• Regulatory Compliance: Meeting reporting obligations to the relevant authorities in accordance with applicable Malaysian law.
• Platform Improvements: Analyzing usage patterns to improve the user experience, platform performance, and game content variety.
• Marketing Communications: Sending promotions, exclusive offers, and platform updates — only where you have given explicit consent to receive such communications.

Luck3 will not use your data for any purpose not stated above without first obtaining your renewed consent.

04Legal Basis for Data Processing

Luck3 processes your personal data on legally recognised grounds under Malaysia's Personal Data Protection Act 2010 (PDPA):

• Contract Performance: Processing required to provide platform services to you, including account management and transaction processing.
• Legal Obligation: Processing required to comply with Malaysian laws, including anti-money laundering (AML) requirements and identity verification.
• Legitimate Interest: Processing for platform security, fraud prevention, and service improvement purposes that do not affect your fundamental rights.
• Consent: For marketing communications and non-essential cookie usage, we rely on your explicit consent. You may withdraw this consent at any time.

05Data Sharing & Disclosure

Luck3 takes a highly cautious approach to data sharing. We does not sell your personal data. Your data is only shared in the following limited situations:

• Trusted Service Providers: Companies that help us operate the platform — such as licensed payment processors, cloud infrastructure providers, and identity verification services. All such providers are bound by strict confidentiality agreements and may only use your data for purposes we specify.
• Legal Authority: Where required by Malaysian law, court order, or official request from a law enforcement agency, we may be required to disclose certain data.
• Fraud Prevention: In situations where sharing information with financial institutions or regulatory bodies is required to investigate or prevent fraud and money laundering.
• Business Transfer: If luck3 is involved in a merger, acquisition, or asset transfer, user data may be transferred. You will be notified in advance if this occurs.

In all data sharing cases, we ensure adequate safeguards are in place to protect your data.

06Data Storage & Security

Your data security is our top technical priority. luck3 implements multiple layers of protection to safeguard your information:

• Encryption in Transit: All data transmitted between your device and our servers is protected with TLS 1.3 / SSL 256-bit encryption.
• Encryption at Rest: Sensitive data such as passwords are stored using strong hashing algorithms (bcrypt). Financial information is stored in encrypted format.
• Access Control: Only authorised luck3 staff with a legitimate business need may access user data. Access is fully monitored and logged.
• Periodic Security Scanning: Our infrastructure undergoes regular penetration testing and security audits by independent third parties.
• Two-Factor Authentication (2FA): luck3's internal systems require 2FA for all staff accessing user data.

Data Retention Period: luck3 retains your personal data for as long as your account is active or as needed to provide our services. Following account closure, certain data will be retained for the period required by Malaysian law — typically 7 years for financial records in accordance with anti-money laundering requirements.

07Cookies & Tracking Technologies

Luck3 uses cookies and similar tracking technologies to enhance user experience and ensure platform security. The following are the types of cookies we use:

• Essential Cookies: Required for core platform functions such as login session verification and security. These cookies cannot be disabled as they are essential for platform operation.
• Performance Cookies: Collecting information on how users interact with the platform — which pages are visited most frequently and any errors encountered. This data is used in aggregate form to improve performance.
• Functional Cookies: Storing user preferences such as language selection, display settings, and game preferences to deliver a more personalized experience.
• Analytics Cookies: Helping us understand overall platform usage patterns. This information is not linked to any individual's personal identity.

Managing Cookies: You can control cookies through your browser settings. However, disabling essential cookies may affect your ability to use the luck3 platform fully. For information on managing cookies in your browser, refer to your browser's help documentation.

08Your Rights as a User

Under Malaysia's PDPA and our privacy policy, you have the following rights regarding your personal data:

• Right of Access: You have the right to request a copy of the personal data we hold about you. This request will be processed within 14 business days.
• Right to Rectification: If any data we hold is inaccurate or outdated, you have the right to request a correction. For basic data, you can update it yourself through your account settings.
• Right to Erasure: In certain circumstances, you have the right to request the deletion of your personal data. Please note that this request may not be fully fulfilled if there are legal obligations to retain such data.
• Right to Object to Processing: You may object to the processing of your data for direct marketing purposes at any time by withdrawing your consent.
• Right to Data Portability: You have the right to receive your personal data in a structured, machine-readable format.
• Right to Withdraw Consent: Where data processing is based on consent, you may withdraw that consent at any time without affecting any processing carried out prior to withdrawal.

To exercise any of the above rights, contact our data protection team by email [email protected] with the subject line "Personal Data Rights Request".

09Children's Data & Minor Protection

The luck3 platform is strictly for users aged 18 and above only. We do not intentionally collect, process, or store personal data of individuals under the age of 18.

Luck3 uses an automated age verification system during the registration process, and subsequent KYC verification requires official identity documents confirming the user's age. Any account found to have been registered by a minor will be terminated immediately and all related data will be deleted.

10Changes to This Privacy Policy

Luck3 reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, new legal requirements, or service improvements. When material changes occur, we will:

• Updating the "Last Updated" date at the top of this document.
• Sending a notification to your registered email address at least 14 days before changes take effect.
• Displaying a clear notice on the platform's home page throughout the transition period.

Your continued use of the luck3 platform after the effective date of any changes will be considered your acceptance of the updated privacy policy terms. If you disagree with the changes, you have the right to close your account before they take effect.

11Contact Us Regarding Privacy

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, the luck3 data protection team is ready to assist:

• Privacy Email: [email protected] — use the subject "Data Privacy Inquiry"
• Live Chat: Available 24/7 directly within the luck3 platform — select the "Privacy & Data" category
• Target Response Time: All privacy enquiries will be responded to within 3 business days; data rights requests within 14 business days.