Lucky 22 Privacy Policy – Your Data, Your Rights Explained

1Who We Are

Lucky 22 operates the online gaming platform available at lucky22.link and is the data controller responsible for the personal data of registered players. When this Privacy Policy refers to "Lucky 22", "we", "us" or "our", it means the operator of the lucky22.link platform.

Lucky 22 is focused exclusively on the Pakistani market. Our platform, payment integrations, customer support and data practices are all designed with Pakistani players in mind. If you have any questions about how your data is handled, you can contact us at any time at support@lucky22.link — our support team operates 24 hours a day in both Urdu and English.

This Privacy Policy applies to all personal data collected through the Lucky 22 website, mobile browser interface and any communications between you and the Lucky 22 support team. It should be read together with the Terms and Conditions, which govern your use of the platform overall.

2Data We Collect

Lucky 22 collects only the personal data that is genuinely necessary to provide you with a functioning, secure and legally compliant gaming platform. The categories of data we collect are set out below.

• Full name (as it appears on your CNIC)
• Date of birth
• Pakistani mobile phone number
• Email address
• Username and encrypted password
• City or province of residence

• CNIC number and copy of CNIC document
• Selfie photograph (where biometric verification is required)
• Proof of address (utility bill or bank statement, if requested)

• Mobile wallet identifiers (Easypaisa, JazzCash, NayaPay, SadaPay account numbers)
• Bank account details for IBFT transfers (account holder name, bank name, account number)
• Last four digits of card number for Visa/Mastercard transactions
• Transaction history: deposit amounts, withdrawal amounts, timestamps

• Bets placed, games played, session durations and outcomes
• Bonuses claimed and wagering progress
• Responsible gaming tool settings (deposit limits, session reminders, self-exclusion status)

• IP address and approximate geographic location
• Device type, operating system and browser version
• Session timestamps and login history
• Cookie identifiers (see Section 9)

• Content of messages sent to Lucky 22 support via live chat or email
• Support ticket history and resolution records

3How We Collect Data

Lucky 22 collects personal data through several channels, all of which are initiated by your interaction with the platform.

• Directly from you: When you register an account, complete identity verification, make a deposit or withdrawal, contact support, or update your account settings.
• Automatically during use: When you browse the Lucky 22 website, log in, place bets or play games, our servers automatically record technical data including your IP address, device information and session activity.
• Via cookies and similar technologies: Lucky 22 uses cookies to remember your preferences, maintain your login session and analyse aggregate usage patterns. See Section 9 for full details on cookies and how to control them.
• From payment providers: When you deposit or withdraw using Easypaisa, JazzCash, NayaPay, SadaPay, IBFT or card, the payment provider may pass back transaction confirmation data including masked payment identifiers.
• From identity verification providers: Where Lucky 22 uses a third-party service to assist with CNIC verification, that provider may return a verification result and a confidence score to Lucky 22.

4Why We Use Your Data

Every piece of data that Lucky 22 holds is used for a specific, documented purpose. We do not use your data for purposes incompatible with those disclosed here, and we do not engage in profiling for advertising purposes or sell insights derived from your data to third parties.

5Legal Basis for Processing

Lucky 22 processes your personal data on one or more of the following legal bases, depending on the specific processing activity:

• Contract performance: Processing necessary to fulfil the Lucky 22 Terms and Conditions — operating your account, processing payments and settling bets.
• Legal obligation: Processing required to comply with anti-money laundering (AML) regulations, identity verification requirements and fraud prevention obligations.
• Legitimate interests: Processing necessary for the legitimate operational interests of Lucky 22, such as platform security, fraud detection and improving service quality — provided these interests are not overridden by your data protection rights.
• Consent: Where Lucky 22 asks for your explicit consent — for example, before sending promotional communications or before using non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

6Who We Share Data With

Lucky 22 does not sell, rent or trade your personal data. Data is shared with third parties only when strictly necessary for the operation of the platform or required by law. The categories of recipients are as follows:

• Payment processors: Easypaisa, JazzCash, NayaPay, SadaPay and Pakistani banking partners receive the minimum data required to process each transaction. These providers operate under their own privacy policies and are regulated by the State Bank of Pakistan.
• Identity verification providers: Where CNIC verification is conducted using a third-party service, that provider receives the necessary identity documents and returns a verification result. Verification providers are contractually bound to process data only for verification purposes.
• Game and platform technology providers: Software providers whose games are hosted on Lucky 22 may receive anonymised session and gaming data necessary to resolve technical disputes or calculate jackpot contributions. They do not receive your full identity data.
• Regulatory and law enforcement authorities: Lucky 22 will disclose personal data to competent authorities when required to do so by applicable law, court order or regulatory instruction. We will notify affected players of such disclosures where legally permitted to do so.
• Fraud prevention and AML services: Lucky 22 may use industry fraud prevention databases to screen accounts and transactions. Data submitted to such services is used solely for fraud and money laundering prevention purposes.

7International Data Transfers

Lucky 22 is focused on the Pakistani market and the majority of data processing occurs within systems that serve Pakistan-based operations. However, some third-party technology providers — including certain game software providers — operate infrastructure outside Pakistan.

Where personal data is transferred to or processed by systems outside Pakistan, Lucky 22 ensures appropriate safeguards are in place, including contractual data processing agreements that require the recipient to maintain data protection standards equivalent to those described in this policy. Lucky 22 does not transfer personal data to jurisdictions that do not provide adequate protections for the nature of data being transferred.

8How Long We Keep Your Data

Lucky 22 retains personal data for as long as your account remains active and for a defined period after account closure, in order to fulfil legal, regulatory and audit obligations. The general retention periods are as follows:

• Account and identity data: Retained for the duration of your account and for five years after account closure, to meet AML record-keeping requirements.
• Transaction records: Retained for seven years after the date of each transaction, in line with standard financial record-keeping practice.
• Gaming activity logs: Retained for two years after your last active session, then anonymised for aggregate analytical purposes.
• Support communications: Retained for two years after a support case is closed, unless the case relates to an unresolved dispute.
• Cookie and session data: Session cookies are deleted when you close your browser. Persistent cookies expire as described in Section 9.

When the applicable retention period expires, Lucky 22 either deletes the data securely or irreversibly anonymises it so that it can no longer be linked to any individual.

9Cookies and Tracking Technologies

Lucky 22 uses cookies — small text files stored on your device — and similar technologies to make the platform work correctly, to remember your preferences and to understand how the site is used in aggregate. We do not use advertising cookies or allow third-party advertising networks to set cookies on Lucky 22 pages.

• Strictly necessary cookies: Required for core platform functions — maintaining your login session, storing your language preference and remembering your responsible gaming settings. These cannot be disabled without breaking the platform.
• Functional cookies: Remember preferences such as your preferred game view or display settings. These improve your experience but are not essential to platform operation.
• Analytics cookies: Used by Lucky 22 to understand aggregate usage patterns — which sections of the platform are visited most, where players encounter difficulty and how the platform performs on different devices. Data is aggregated and does not identify individuals. These cookies are set only with your consent.

You can manage cookie preferences from your browser settings. Most browsers allow you to block or delete cookies, though doing so may affect the functionality of the Lucky 22 platform. Strictly necessary cookies cannot be disabled while you remain logged in.

10Your Rights Over Your Data

As a Lucky 22 player, you have clear rights over the personal data we hold about you. Lucky 22 is committed to honouring these rights promptly and without unnecessary friction. To exercise any of these rights, contact support@lucky22.link with the subject line "Data Rights Request".

Lucky 22 will respond to all data rights requests within 30 days. If an extension is required due to complexity, we will inform you within the initial 30-day period. There is no charge for exercising your rights in good faith.

11Children's Privacy

Lucky 22 is strictly an adults-only platform. No person under the age of 18 is permitted to register an account or use any Lucky 22 service. Lucky 22 does not knowingly collect personal data from anyone under 18.

If Lucky 22 becomes aware that an account was registered by or on behalf of a minor, that account will be closed immediately, all associated data will be deleted (or retained only as required by applicable law), and any deposits will be refunded to the payment method used.

If you are a parent or guardian and have reason to believe your child has registered on Lucky 22, please contact support@lucky22.link immediately with the subject line "Underage Account" and we will investigate and take action within 24 hours.

12Security Measures

Lucky 22 takes the security of your personal data seriously and implements multiple technical and organisational safeguards to protect it from unauthorised access, disclosure, alteration and destruction.

• SSL/TLS encryption: All data transmitted between your device and Lucky 22 servers is encrypted using industry-standard TLS (Transport Layer Security). You can verify this by checking for the padlock symbol in your browser's address bar.
• Password hashing: Passwords are never stored in plain text on Lucky 22 systems. They are hashed using a strong cryptographic algorithm before storage.
• Two-factor authentication (2FA): Available on all Lucky 22 accounts and strongly recommended. 2FA adds a second layer of protection even if your password is compromised.
• Access controls: Internal access to player data within Lucky 22 is restricted on a need-to-know basis. Support agents access only the data relevant to the query they are handling.
• Security monitoring: Lucky 22 operates automated systems to detect suspicious login activity, unusual transaction patterns and potential account takeover attempts.

While Lucky 22 takes all reasonable steps to protect your data, no internet-based system can guarantee absolute security. If you suspect your Lucky 22 account has been compromised, contact support@lucky22.link immediately.

13Marketing Communications

Lucky 22 may send promotional communications about new games, bonuses, special offers and platform updates. All marketing communications are sent on the basis of your explicit consent, which you can provide or withdraw at any time.

• During registration, you will be asked whether you wish to receive promotional emails and/or SMS messages from Lucky 22. Selecting "No" opts you out immediately.
• Every marketing email sent by Lucky 22 includes a clearly visible unsubscribe link. Clicking it removes your email address from all marketing lists within 48 hours.
• To opt out of SMS marketing messages, reply STOP to any Lucky 22 SMS or contact support@lucky22.link requesting removal.
• Opting out of marketing communications does not affect service communications — we will still send you important account notifications, deposit confirmations, withdrawal alerts and security notifications.

Lucky 22 does not send marketing communications on behalf of third parties and does not share your contact details with any external marketing partner.

14Changes to This Privacy Policy

Lucky 22 may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements or the services we offer. When material changes are made, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to your registered address at least 14 days before the changes take effect
• Display a notice on the Lucky 22 website for 30 days after the change becomes effective

Your continued use of Lucky 22 after the effective date of any updated Privacy Policy constitutes your acceptance of the updated terms. If you do not accept the changes, you should stop using the platform and contact support to close your account and request data erasure.

The current version of this Privacy Policy is always available at lucky22.link/privacy-policy. We recommend saving or bookmarking that page.

15Contact and Complaints

If you have any questions, concerns or complaints about how Lucky 22 handles your personal data, the first step is to contact our support team directly. We take privacy complaints seriously and will respond with a substantive answer rather than a generic acknowledgement.

If you are not satisfied with Lucky 22's response to a privacy complaint, you have the right to raise the matter with the relevant data protection authority in your jurisdiction. Lucky 22 will cooperate fully with any formal regulatory investigation.