luki22 Privacy Policy

luki22 operates the online gaming platform accessible at luki22.net, providing cricket betting, live casino, slots, and sports wagering services to players in Pakistan. In doing so, luki22 collects and processes personal data about its players as a necessary part of providing those services responsibly, securely, and in compliance with applicable regulatory obligations.

This Privacy Policy explains luki22's data practices in plain, straightforward terms. It is intended to give every Pakistani player a clear understanding of what happens to their personal information from the moment they visit the luki22 platform through to the closure of their account and beyond.

This Privacy Policy should be read alongside the luki22 Terms & Conditions, which govern the overall player agreement. In the event of any conflict between this Privacy Policy and the Terms & Conditions on a matter relating to data, this Privacy Policy shall prevail.

For the purposes of this Privacy Policy, luki22 acts as the data controller in respect of all personal data collected from players using the luki22 platform. As data controller, luki22 determines the purposes and means of processing your personal data and is responsible for ensuring that such processing complies with applicable data protection principles.

All data protection enquiries, access requests, and complaints relating to luki22's data practices should be directed to the luki22 Data Privacy team via the contact details provided in Section 16 of this policy.

luki22 collects only the personal data necessary to provide its gaming services, comply with regulatory obligations, and maintain the security of the platform. The categories of personal data luki22 collects are as follows:

luki22 does not collect sensitive special-category personal data (such as health data, biometric data, or political opinions) from players, except where such data is voluntarily provided in the context of a responsible gaming support interaction, in which case it is treated with the highest level of confidentiality.

luki22 collects your personal data through the following means:

• Direct submission: When you register a luki22 account, complete KYC verification, make a deposit or withdrawal, contact support, or respond to a promotion.
• Automated technical collection: When you browse or interact with the luki22 platform, technical data including your IP address, device identifiers, session logs, and cookie data is collected automatically by luki22's platform infrastructure.
• Third-party sources: luki22 may receive identity verification data from CNIC verification service providers, fraud screening data from anti-fraud partners, and payment confirmation data from JazzCash, EasyPaisa, HBL, UBL, Meezan Bank, and other payment processors in order to validate transactions.

luki22 processes your personal data on the following legal bases:

• Contractual necessity: Processing is necessary to perform the player agreement (Terms & Conditions) — including operating your account, processing deposits and withdrawals, and delivering gaming services.
• Legal obligation: Processing is required to comply with anti-money laundering regulations, age verification obligations, and data disclosure requirements imposed by regulatory and law enforcement authorities.
• Legitimate interests: Processing is carried out for luki22's legitimate interests in fraud prevention, platform security, responsible gaming monitoring, and service improvement, provided these interests are not overridden by your privacy rights.
• Consent: Where luki22 sends you marketing communications or uses non-essential cookies, it does so on the basis of your explicit consent, which you may withdraw at any time.

luki22 uses the personal data it collects for the following specific purposes:

• Creating and managing your luki22 player account, including verifying your identity and age (21+) through the KYC process.
• Processing PKR deposits and withdrawals via JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, 1LINK, and bank transfer channels.
• Settling bets, crediting winnings, and managing bonus funds in accordance with the luki22 Terms & Conditions.
• Detecting and preventing fraudulent activity, multi-accounting, bonus abuse, and money laundering on the platform.
• Monitoring gaming behaviour to identify indicators of problem gambling and providing appropriate responsible gaming interventions where necessary.
• Providing customer support and resolving account disputes, bet settlement queries, and payment issues.
• Sending you account-critical communications including deposit confirmations, withdrawal notifications, security alerts, and responsible gaming notifications.
• Sending promotional communications, bonus offers, and event notifications where you have provided your consent to receive such communications.
• Improving the luki22 platform through analysis of aggregated, anonymised usage data.
• Complying with all applicable regulatory, legal, and licensing obligations.

luki22 does not sell, rent, or trade your personal data to any third party for commercial purposes. Your data is shared only with the following categories of recipients, and only to the extent necessary for the stated purpose:

• Identity Verification Providers: CNIC and identity document verification services used to confirm the identity and age of players during the KYC process.
• Payment Processors: JazzCash, EasyPaisa, Raast, HBL, UBL, Meezan Bank, and 1LINK receive the transaction data necessary to process your deposits and withdrawals. Each payment processor operates under its own privacy policy and regulatory obligations.
• Game Technology Providers: Providers such as PG Soft, Pragmatic Play, Evolution Gaming, and Habanero may receive your player session identifiers and stake data as technically necessary to deliver their game content on the luki22 platform. These providers do not receive your CNIC, financial data, or contact details.
• Anti-Fraud and Security Partners: Third-party fraud screening and device fingerprinting services receive technical data (IP addresses, device identifiers) necessary for fraud prevention. No identity or financial data is shared with these providers beyond what is strictly necessary.
• Regulatory and Law Enforcement Authorities: luki22 will disclose personal data to the Financial Monitoring Unit of Pakistan (FMU), the Federal Investigation Agency (FIA), or any other competent authority where required to do so by applicable law, court order, or regulatory directive. luki22 will not notify you of such disclosure where doing so is prohibited by law or would compromise an investigation.
• Professional Advisors: Lawyers, auditors, and compliance consultants engaged by luki22 may access personal data on a strictly confidential, need-to-know basis in connection with legal proceedings, regulatory reviews, or financial audits.

Some of luki22's technology and service partners — including game content providers and cloud infrastructure providers — may process or store personal data outside Pakistan. Where such transfers occur, luki22 ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that required under applicable data protection frameworks.

Safeguards used by luki22 for international data transfers include contractual data processing agreements with all third-party processors, data minimisation (sharing only what is strictly necessary for the stated purpose), and restricting transfers to processors located in jurisdictions with recognised data protection standards.

luki22 retains your personal data for the following periods:

• Active account data: Retained for the full duration of your luki22 account being active.
• Post-closure account data: Following account closure for any reason, luki22 retains full account records — including identity verification documents, transaction history, and gaming records — for a minimum of five years to satisfy anti-money laundering record-keeping obligations.
• Support communications: Retained for three years following the resolution of the relevant support interaction, to provide evidence in the event of subsequent disputes.
• Marketing consent records: Retained for the period of the consent plus two years following its withdrawal, to evidence compliance with marketing regulations.
• Technical logs: Retained for a rolling period of twelve months for security and fraud investigation purposes.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual. luki22 reviews its data retention practices on an annual basis to ensure continued necessity and proportionality.

luki22 uses cookies and similar tracking technologies on the luki22 platform for the following purposes:

• Essential cookies: Required for the platform to function correctly — including maintaining your login session, remembering your language and currency preferences, and enabling security features. These cookies cannot be disabled without affecting platform functionality.
• Analytics cookies: Used to collect anonymised, aggregated data about how players use the luki22 platform — which pages are visited most frequently, where users drop off, and how performance can be improved. Analytics data does not identify individual players.
• Security cookies: Used for fraud detection, bot prevention, and platform security monitoring. These cookies record technical identifiers such as session tokens and device fingerprints.

Non-essential cookies are used only with your consent. You may manage your cookie preferences at any time through your browser settings. Disabling non-essential cookies will not prevent you from using the core luki22 gaming platform, though some personalisation features may be affected.

luki22 sends promotional communications — including bonus offers, deposit match promotions, PSL cricket betting offers, and free spin notifications — only to players who have provided their explicit consent to receive such communications at the time of registration or subsequently through their Account Settings.

You may withdraw your consent to receive marketing communications at any time by updating your notification preferences in your luki22 Account Settings, or by contacting luki22 support directly. Withdrawal of marketing consent does not affect the lawfulness of any marketing communications sent prior to that withdrawal.

luki22 does not share your contact details with third-party marketers or advertisers. All promotional communications you receive from luki22 are sent directly by luki22 and relate exclusively to luki22 platform offers and services.

The luki22 platform is strictly intended for individuals aged 21 and above. luki22 does not knowingly collect personal data from individuals under the age of 21 and does not direct any marketing communications at minors.

luki22 enforces a mandatory age verification process through CNIC submission during KYC. Any account found to have been registered by an individual under the age of 21 will be immediately suspended, all balances will be frozen pending investigation, and all personal data associated with that account will be deleted following the completion of any required regulatory reporting.

If luki22 becomes aware that it has inadvertently collected personal data from a minor, it will take immediate steps to delete that data and notify the relevant responsible gaming authority where required.

luki22 implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure:

• Encryption in transit: All data transmitted between your browser or mobile device and luki22's servers is encrypted using 256-bit TLS (Transport Layer Security) protocols.
• Encryption at rest: Sensitive personal data stored in luki22's databases — including CNIC data, payment identifiers, and authentication credentials — is encrypted using AES-256 encryption at rest.
• Access controls: Access to personal data within luki22's internal systems is restricted on a strict need-to-know basis. All staff with access to personal data are subject to confidentiality obligations and regular data protection training.
• Penetration testing: luki22's platform undergoes regular third-party security assessments and vulnerability testing to identify and remediate security weaknesses before they can be exploited.
• Incident response: luki22 maintains a documented data breach response procedure. In the event of a data breach that affects your personal data, luki22 will notify you and the relevant authorities within the timeframes required by applicable regulations.

While luki22 implements rigorous security measures, no online platform can guarantee absolute security. Players are encouraged to maintain strong, unique passwords for their luki22 accounts and to enable all available account security features.

Subject to applicable law and luki22's legal retention obligations, you have the following rights in relation to the personal data luki22 holds about you:

• Right of access: You may request a copy of all personal data luki22 holds about you. luki22 will respond to access requests within 30 days.
• Right to rectification: If any personal data luki22 holds about you is inaccurate or incomplete, you may request that it be corrected. Identity data corrections may require resubmission of updated KYC documentation.
• Right to erasure: You may request deletion of your personal data where luki22 no longer has a legal basis to retain it. Note that luki22 is legally required to retain certain data for a minimum of five years following account closure regardless of an erasure request.
• Right to restrict processing: You may request that luki22 restricts its processing of your personal data in certain circumstances — for example, where you contest the accuracy of data and luki22 is verifying it.
• Right to object: You may object to luki22 processing your data on the basis of its legitimate interests, including for direct marketing purposes. An objection to marketing communications will be honoured immediately.
• Right to data portability: You may request that luki22 provides your personal data in a structured, machine-readable format for transfer to another controller where technically feasible.

To exercise any of the rights listed above, please contact luki22's Data Privacy team via the details in Section 16. luki22 may need to verify your identity before processing your request. All requests are handled free of charge unless manifestly unfounded or excessive.

luki22 reviews this Privacy Policy periodically and will update it when changes to luki22's data practices, applicable regulations, or platform functionality require it. The date of the most recent update is displayed at the top of this document.

Material changes to this Privacy Policy — meaning changes that affect how your personal data is used in ways that are substantively different from this version — will be communicated to registered players via email or via an in-platform notification with a minimum of seven days' notice before the changes take effect, except where immediate amendment is required by law.

Your continued use of the luki22 platform after the effective date of any amendment to this Privacy Policy constitutes your acceptance of the updated policy. If you do not agree with an amended policy, you should close your luki22 account before the effective date of the amendment.

For any questions, concerns, or requests relating to this Privacy Policy or luki22's data practices, please contact the luki22 Data Privacy team through the following channel:

Email (plain text — not a link): [email protected]

Subject line: Please mark privacy-related emails with the subject "Privacy Enquiry – [Your CNIC last 4 digits]" so that they are routed to the appropriate team promptly.

Live Chat: Available 24/7 via the luki22 platform after logging in to your account. Select "Privacy & Data" from the support topic menu.

luki22 aims to acknowledge all privacy enquiries within 24 hours and to provide a substantive response within 30 calendar days. Where a request is complex or luki22 is handling a high volume of requests, the response period may be extended by up to a further 60 days — in which case luki22 will notify you of the extension and the reason for it.