33 lucky Privacy Policy — How We Handle Your Personal Data

1. Introduction

33 lucky is an online gaming platform operated for users in Pakistan. We are committed to protecting the privacy of every user and handling personal data responsibly, transparently, and in accordance with applicable data protection principles. This Policy applies to all data collected through the 33 lucky website at 33lucky.net, the 33 lucky mobile app for Android and iOS, live chat and email communications with 33 lucky support, and any other interaction you have with the 33 lucky platform.

This Policy should be read alongside the 33 lucky Terms & Conditions, which govern your overall use of the platform. Defined terms used in this Policy that are not defined here carry the meanings given to them in the Terms & Conditions.

2. Data We Collect

33 lucky collects personal data through several channels. The categories of data and the context in which each is collected are described below.

2.1 Registration Data

When you create a 33 lucky account, we collect: your full legal name, date of birth, email address, Pakistani mobile number, and a username of your choice. This information is required to establish and maintain your account.

2.2 Identity Verification (KYC) Data

To comply with anti-money laundering (AML) obligations and to verify the age of users (18+ requirement), 33 lucky may request: a copy of your CNIC (Computerised National Identity Card), a recent utility bill or bank statement showing your Pakistan address, and in some cases a selfie photograph alongside your CNIC. KYC documents are processed securely and stored only for as long as legally required.

2.3 Financial Transaction Data

When you make a PKR deposit or request a withdrawal, we record the transaction amount in PKR, the payment method used (Easypaisa, JazzCash, Raast, bank transfer, or USDT TRC20), the transaction reference number issued by the payment provider, the date and time of the transaction, and the resulting account balance. We do not store full mobile wallet credentials or complete bank account numbers — payment processing is handled directly by the respective payment service providers.

2.4 Gameplay and Activity Data

33 lucky records your game session history, including which games were played, wager amounts in PKR, outcomes, session duration, and bonus usage. This data is used for account management, responsible gaming monitoring, dispute resolution, and fraud prevention.

2.5 Technical and Device Data

We automatically collect certain technical data when you access 33 lucky, including your IP address, browser type and version, operating system, device identifiers (for mobile app users), and approximate geographic location derived from your IP address. This data is used for security monitoring and platform optimisation.

2.6 Communications Data

If you contact 33 lucky support via live chat or email, we retain the content of those communications for quality assurance, compliance, and dispute resolution purposes.

3. Why We Use Your Data

33 lucky uses the personal data described above for the following purposes:

4. Legal Basis for Processing

33 lucky processes your personal data on the following legal bases:

• Contract performance: Processing necessary to provide you with the 33 lucky account and gaming services you have requested, including managing your PKR balance and processing transactions.
• Legal obligation: Processing required to comply with anti-money laundering regulations, age verification requirements, and financial record-keeping obligations applicable to online gaming operators.
• Legitimate interests: Processing for fraud prevention, platform security, responsible gaming monitoring, and service improvement — activities that serve the platform's operational integrity without overriding your fundamental privacy rights.
• Consent: Processing for optional promotional communications, where your separate opt-in consent is obtained and can be withdrawn at any time without affecting your access to the platform.

5. Sharing Your Data

33 lucky does not sell personal data to third parties. We share your data only in the following circumstances:

5.1 Service Providers

We share data with third-party service providers who assist in operating 33 lucky, including payment processing partners (Easypaisa, JazzCash), identity verification service providers, game software providers, cloud hosting providers, and live chat software operators. All service providers are contractually bound to process data only as instructed by 33 lucky and to maintain appropriate security standards.

5.2 Legal and Regulatory Disclosure

33 lucky may disclose personal data to regulatory bodies, law enforcement agencies, or courts where required by applicable law or by a valid legal order. We will notify you of any such disclosure where we are legally permitted to do so.

5.3 Business Transfers

In the event that 33 lucky undergoes a merger, acquisition, or sale of its business assets, user data may be transferred as part of that transaction. You will be notified in advance of any such transfer and of any change in the privacy practices that would apply to your data.

6. Payment Data & PKR Transactions

All PKR deposits at 33 lucky are processed through Easypaisa, JazzCash, Raast, or standard Pakistani bank transfer, each of which operates under its own security and privacy framework regulated in Pakistan. 33 lucky receives transaction confirmation and reference data from these providers but does not receive or store your full mobile wallet PIN, bank account credentials, or card data.

USDT TRC20 transactions for users who choose this method are processed via blockchain infrastructure. Blockchain transactions are publicly visible by nature; 33 lucky does not control the public visibility of on-chain transaction records.

Financial transaction records are retained for a minimum of five years from the date of transaction to comply with anti-money laundering record-keeping obligations. After this period, transaction records are securely deleted or anonymised.

7. Cookies & Tracking Technologies

7.1 What We Use

33 lucky uses cookies and similar technologies including local storage and session tokens to operate the platform. These fall into the following categories:

• Strictly necessary cookies: Required to maintain your login session, remember your language preference, and operate the cashier. These cannot be disabled without preventing you from using the platform.
• Functional cookies: Remember your game display preferences, responsible gaming settings, and interface customisations between sessions.
• Analytics cookies: Help 33 lucky understand how users navigate the platform so we can identify and fix usability issues. Analytics data is aggregated and not linked to individual identities.
• Security cookies: Detect and prevent fraudulent activity, including CSRF protection tokens and device fingerprinting used to identify unauthorised account access attempts.

7.2 Managing Cookies

You can control non-essential cookies through your browser settings or through the cookie preference centre accessible at the bottom of the 33 lucky website. Note that disabling strictly necessary cookies will prevent you from logging into your account or using the cashier.

8. Data Retention

33 lucky retains personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply as a general guide:

• Active account data: Retained for the duration of your account plus 5 years following account closure.
• KYC verification documents: Retained for a minimum of 5 years from the date of verification, as required under AML regulations.
• Financial transaction records: Retained for a minimum of 5 years from the date of each transaction.
• Gameplay history: Retained for 2 years from the date of each session for responsible gaming monitoring and dispute resolution purposes.
• Support communications: Retained for 2 years from the date of the last communication in a support thread.
• Technical logs: Retained for 12 months and then automatically deleted.

After the applicable retention period, data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual user.

9. Security Measures

33 lucky implements the following technical and organisational measures to protect your personal data:

• All data transmitted between your device and 33 lucky servers is encrypted using TLS 1.2 or higher.
• Account passwords are stored using one-way cryptographic hashing — 33 lucky staff cannot read your password.
• Access to personal data within 33 lucky is restricted on a need-to-know basis, with role-based access controls for staff.
• Servers hosting 33 lucky data are located in secure data centres with physical access controls, intrusion detection systems, and regular security audits.
• Two-factor authentication (2FA) is available for user accounts and is mandatory for 33 lucky administrative access.
• 33 lucky conducts regular internal security reviews and responds to security vulnerability reports.

10. Your Rights

As a 33 lucky user, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected] with the subject line "Data Rights Request":

• Right of access: Request a copy of the personal data 33 lucky holds about you.
• Right to rectification: Ask us to correct inaccurate or incomplete personal data in your account.
• Right to erasure: Request deletion of your personal data where there is no longer a lawful basis for us to retain it. Note that data subject to legal retention obligations (such as KYC and financial records) cannot be deleted before the statutory retention period expires.
• Right to restrict processing: Ask 33 lucky to pause processing your data in certain circumstances, for example while a dispute about its accuracy is resolved.
• Right to data portability: Request your account data in a structured, machine-readable format where technically feasible.
• Right to withdraw consent: Withdraw consent for any processing based on your consent (such as promotional emails) at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to object: Object to processing of your data where we rely on legitimate interests as the legal basis, if you believe our interests are overridden by your own interests or fundamental rights.

33 lucky will respond to all data rights requests within 30 days. Where a request is complex or numerous, this period may be extended by a further 60 days with notification to you.

11. Minors — Under-18 Policy

33 lucky does not knowingly collect personal data from individuals under 18 years of age. The platform is strictly 18+ and age verification is enforced at the point of registration and during KYC review. If 33 lucky becomes aware that an account has been registered by a person under 18, the account will be immediately closed and all associated personal data will be deleted, except where retention is required by law for AML or fraud investigation purposes. If you believe a minor has registered on 33 lucky, please report this to [email protected] immediately.

12. International Data Transfers

33 lucky operates servers and utilises service providers that may be located outside Pakistan. Where personal data is transferred to countries that do not have data protection laws equivalent to those applicable in Pakistan, 33 lucky ensures adequate safeguards are in place. These safeguards include contractual data processing agreements with receiving parties that require them to protect data to standards consistent with this Policy. By using 33 lucky, you acknowledge that your data may be processed in jurisdictions outside Pakistan for the operational purposes described in this Policy.

13. Changes to This Privacy Policy

33 lucky reserves the right to update this Privacy Policy at any time. Where changes are material — for example, changes to the categories of data collected, the purposes for which data is used, or the third parties with whom it is shared — 33 lucky will provide notice to registered users via their registered email address and via an in-platform notification at least 14 days before the revised Policy takes effect. Your continued use of 33 lucky after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not accept the revised Policy, you should close your account before the effective date.

14. Contact — Data & Privacy Enquiries

For any questions, concerns, or requests relating to this Privacy Policy or your personal data held by 33 lucky, please contact our support team using the details below:

• Email: [email protected] — subject line "Privacy Enquiry" or "Data Rights Request"
• Live Chat: Available 24/7 via the chat icon on the 33 lucky platform
• Response Time: We aim to acknowledge all privacy-related enquiries within 2 business days and provide a full response within 30 days

For further information about your rights or general data protection guidance, you may also consult the Frequently Asked Questions page on 33 lucky.