Privacy Policy mylucky —
Your Personal Data Protection

Welcome to mylucky's Privacy Policy. This document is a legally binding agreement between you as a user of the Platform and mylucky as the responsible data controller. By using any part of our Platform, you acknowledge that you have read, understood, and fully agreed to this Privacy Policy.

Mylucky is committed to protecting the privacy of every member who uses our services in Malaysia. We comply with Malaysia's Personal Data Protection Act 2010 (PDPA), which governs how we process, store, and use the personal information you provide to us. We believe transparency is the foundation of trust, which is why we strive to explain every aspect of our data management in language that is easy for all users to understand.

This Privacy Policy applies to all information collected through the mylucky website, mobile app, live chat, and any other communication channels we use to interact with our members. It also applies to information we receive from trusted third parties such as our payment providers and KYC partners.

The types of information we collect depend on how you interact with our Platform. Generally, we collect three main categories of information:

Information you provide directly: This includes your full name, date of birth, identification number, email address, phone number, residential address, and bank account or digital wallet details collected during registration and KYC verification.

Information collected automatically: When you use our Platform, our systems automatically record your IP address, device and browser type, login and logout times, financial transaction records, game history, and your platform preferences.

Information from third parties: In certain situations, we may receive additional information from third-party KYC providers we use for identity verification purposes, as well as information from financial institutions regarding transactions you carry out through the Platform.

Every piece of information we collect is used for a clear and legitimate purpose. mylucky does not use your data for any purpose not stated in this Policy without obtaining your consent first.

• Identity Verification (KYC): Your personal information is used to verify your identity, confirm that you meet the age eligibility requirements, and comply with anti-money laundering (AML) legal obligations.
• Transaction Processing: Your financial data is required to securely process deposits and withdrawals via FPX, digital wallets, and online banking channels supported by the Platform.
• Account Security: Device information and IP addresses are used to detect suspicious activity, prevent unauthorized access, and protect your account from security threats.
• Customer Support: Communication records and transaction history are retained to help our support team resolve your queries or disputes faster and more accurately.
• Responsible Gaming: Your game history is monitored to detect patterns that may indicate signs of problem gambling, enabling us to offer timely assistance.
• Platform Improvements: Anonymised usage data is used to understand how members interact with the Platform in order to improve the overall user experience.
• Marketing Communications: With your consent, we use your contact information to send you promotional offers, updates on new games, and exclusive VIP deals relevant to your preferences.

Mylucky does not sell, rent, or trade your personal information to any third party for commercial purposes. However, there are limited situations where we need to share your information with certain parties:

• Trusted Service Providers: We work with payment providers, KYC verification companies, and gaming software platforms that have signed strict confidentiality agreements with mylucky. They only receive the information needed to carry out their specific functions.
• Legal Requirements: mylucky will disclose information to government authorities or law enforcement agencies when required by Malaysian law or a valid court order.
• Rights Protection: We may share information necessary to protect the rights, property, or safety of mylucky, our members, or the public from fraudulent or criminal activity.
• Business Transfer: In the event of a merger, acquisition, or sale of company assets, member information may be transferred to the new entity subject to an equivalent or stricter privacy policy.

In all of the above data-sharing situations, mylucky ensures that the receiving parties are bound by equivalent confidentiality obligations and are not permitted to use your data for any purpose other than those stated.

Protecting your personal information is mylucky's top priority. We continuously invest in the latest security infrastructure to ensure your data is always protected against increasingly sophisticated cyber threats.

The security measures we employ include:

• 256-bit SSL Encryption: All data transmitted between your device and mylucky's servers is encrypted using TLS 1.3 protocol with 256-bit encryption, ensuring no third party can intercept your communications.
• Stored Data Encryption: Sensitive information such as passwords and financial details is stored in encrypted form within our databases using industry-certified encryption algorithms.
• Two-Factor Authentication (2FA): 2FA is available for all member accounts to add an extra layer of security during the login process.
• 24/7 Monitoring: Our security systems are monitored around the clock by a team of cybersecurity experts responsible for detecting and responding to any threats in real time.
• Regular Security Audits: mylucky conducts regular penetration testing and security audits by independent third-party experts to identify and address any system vulnerabilities.

Mylucky uses cookies and similar tracking technologies to enhance your experience on our Platform. Cookies are small text files stored on your device when you visit our website.

We use several types of cookies:

• Essential Cookies: These cookies are required for the Platform's core functions, including login session management, language preferences, and account security. They cannot be disabled without affecting Platform functionality.
• Performance Cookies: Used to collect anonymised usage statistics to help us understand how users interact with the Platform and identify areas for improvement.
• Functional Cookies: Saves your preferences such as game selections, display settings, and preferred language so you do not need to reconfigure them each time you log in.

You can manage cookies through your browser settings at any time. However, disabling certain cookies may affect the functionality and user experience of the Platform.

Your personal information is stored on secure servers. Our data retention periods are based on legal and legitimate operational requirements:

• Active account information is retained for the duration of your active membership plus seven (7) years after account closure, as required by Malaysia's AML regulations.
• Financial transaction records are retained for a minimum of seven (7) years for tax compliance and financial regulatory purposes.
• Customer support communication logs are retained for three (3) years after the last case resolution.
• Data collected for marketing purposes is retained until you withdraw your consent or close your account.

Where data processing is required to be carried out by partner vendors outside Malaysia, mylucky ensures that such transfers are subject to appropriate safeguards, including data transfer agreements that comply with Malaysia's PDPA standards.

Under Malaysia's Personal Data Protection Act 2010 (PDPA), you have the following rights regarding the personal information we hold about you:

• Right to Access: You have the right to request a copy of the personal information we hold about you. This request will be processed within 21 business days.
• Right to Rectification: If any information is inaccurate or outdated, you have the right to request a correction at no charge.
• Right to Withdraw Consent: You may withdraw your consent to data processing for marketing purposes at any time without affecting your core services.
• Right to Complain: If you believe your privacy rights have been violated, you have the right to file a complaint with Malaysia's Department of Personal Data Protection.

To exercise any of the above rights, please contact the mylucky customer support team via live chat. We will respond to your request within the timeframe required by law.

The mylucky platform is strictly for individuals aged 18 and above. We do not knowingly collect any personal information from individuals under the age of 18.

If we discover that we have unknowingly collected information from a minor, we will take immediate steps to delete that information and close the account in question. If you believe your child who is under age has registered an account on our Platform, please contact us immediately for data removal.

Mylucky reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our data management practices, legal requirements, or service improvements. Any material amendments will be communicated to you via email notice or a prominent notice on the Platform at least 14 days before the changes take effect.

You are encouraged to review this Privacy Policy periodically. The "Latest Version" date shown at the top of this document will be updated whenever amendments are made. Continued use of the Platform after any amendment will be deemed your acceptance of the revised terms.

If you have any questions, concerns, or complaints regarding this Privacy Policy or how we handle your personal information, mylucky's Data Protection Officer (DPO) team is ready to assist you.

You can reach us via:

• Live Chat: Available 24 hours a day, 7 days a week via the chat icon at the bottom corner of the Platform.
• Email: [email protected] — we aim to respond within 2 business days.

We are committed to responding to every privacy-related inquiry seriously and within a reasonable timeframe. Your security and trust are our top priority.