Lucky.ph is committed to protecting your personal data in full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and the regulations issued by the National Privacy Commission. This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and what rights you hold as a lucky.ph player.
Six core principles that govern every decision we make about your personal information.
All personal data processed by lucky.ph is handled in strict accordance with the Philippine Data Privacy Act of 2012 (RA 10173) and the implementing rules issued by the National Privacy Commission (NPC).
Lucky.ph collects only the personal data necessary for the specific purposes described in this Policy. We do not collect data speculatively or use data for purposes beyond those disclosed at the time of collection.
Under the Philippine DPA, you hold concrete rights over your data — access, correction, deletion, objection, and portability. Lucky.ph provides a straightforward process for exercising every one of these rights.
Lucky.ph does not sell, rent, or trade your personal data to third parties for their own marketing purposes. Data sharing with third parties occurs only where required by law, by PAGCOR regulation, or to deliver the services you explicitly use.
Your data is protected in transit and at rest by 256-bit SSL/TLS encryption. Access to personal data within lucky.ph's systems is restricted on a strict need-to-know basis with full audit logging.
Lucky.ph retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law including AMLA obligations. Data is securely disposed of when the retention period expires.
The personal data of lucky.ph players and website visitors is processed by the operator of the lucky.ph platform, accessible at luckyph.bio ("lucky.ph," "we," "us," or "our"). Lucky.ph operates under authorization from the Philippine Amusement and Gaming Corporation (PAGCOR) and is subject to the jurisdiction of the Republic of the Philippines.
As the personal information controller (PIC) as defined under Section 3(h) of the Philippine Data Privacy Act of 2012 (RA 10173), lucky.ph determines the purposes and means of processing personal data collected through the platform. Our designated Data Protection Officer (DPO) can be contacted at the details provided in Section 14 of this Policy.
Scope of This Policy: This Privacy Policy applies to all personal data collected through the luckyph.bio website, the lucky.ph gaming platform, player account registration and verification processes, customer support interactions, and any other touchpoints through which lucky.ph collects data from or about you.
Lucky.ph collects the following categories of personal data when you register, verify your identity, or interact with our support team:
| Data Category | Specific Data Points | When Collected |
|---|---|---|
| Identity Data | Full legal name, date of birth, government ID type and number, photograph | Account registration; KYC verification |
| Contact Data | Philippine mobile number, email address, residential address | Account registration; account updates |
| Financial Data | GCash/PayMaya account reference, bank account details, transaction history, deposit and withdrawal records | Payment processing; withdrawal processing; KYC |
| Verification Documents | Copies of government-issued ID (SSS, Passport, Driver's License, UMID, PhilSys, Voter's ID) | KYC verification; withdrawal processing |
| Communications Data | Support chat transcripts, email correspondence, complaint records | Support interactions; dispute resolution |
| Responsible Gaming Data | Self-exclusion elections, deposit limit settings, session time preferences, problem gambling disclosures | Responsible gaming tool activation |
When you access and use the lucky.ph platform, certain technical and behavioural data is collected automatically through server logs, cookies, and similar tracking technologies:
Lucky.ph may receive limited personal data about you from third-party sources in the following circumstances: identity and age verification service providers used during KYC processing; payment processors including GCash, PayMaya, BPI, BDO, and Metrobank for transaction confirmation; fraud detection and AML screening service providers; and PAGCOR or other regulatory bodies where disclosure is required by law.
Lucky.ph processes your personal data for the following specific, legitimate purposes:
Under the Philippine Data Privacy Act, lucky.ph processes personal data on the following legal bases:
Withdrawing Consent: Where processing is based on your consent, you may withdraw it at any time by updating your account communication preferences or contacting lucky.ph's Data Protection Officer at the details in Section 14. Withdrawal of consent does not affect processing conducted prior to the withdrawal.
Lucky.ph shares personal data with third parties only to the extent necessary for the purposes described in this Policy. Recipients of personal data include:
Lucky.ph does not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. All data sharing arrangements with third-party service providers are governed by written data processing agreements that impose obligations equivalent to those in this Policy.
In the event of a merger, acquisition, restructuring, or sale of all or part of the lucky.ph business, your personal data may be transferred to the acquiring entity. Lucky.ph will notify you of any such transfer via your registered email address before it takes effect, and the acquiring entity will be required to process your data in accordance with this Policy or an equivalent standard.
Lucky.ph's primary data processing infrastructure is located within the Philippines. In certain circumstances — including the use of internationally-operated game content suppliers, cloud infrastructure providers, or KYC verification services — your personal data may be transferred to and processed in countries outside the Philippines.
Where such transfers occur, lucky.ph ensures that an adequate level of data protection is maintained through one or more of the following mechanisms: the recipient country has been recognised by the NPC as providing adequate protection; contractual clauses incorporating the NPC's standard data protection requirements have been executed with the recipient; or the transfer falls within a permitted exception under Section 21 of the Data Privacy Act.
Your Rights on Transfers: You may request information about the specific safeguards applicable to any cross-border transfer of your data by contacting lucky.ph's Data Protection Officer at the details provided in Section 14.
Lucky.ph retains personal data for the periods set out below, after which data is securely deleted or anonymised in a manner that prevents identification:
| Data Category | Retention Period | Legal Basis for Retention |
|---|---|---|
| Account and Identity Data | Duration of account + 5 years after closure | PAGCOR authorization; DPA compliance |
| Financial and Transaction Records | 10 years from transaction date | AMLA (RA 9160, as amended by RA 11521) |
| KYC and Verification Documents | Duration of account + 5 years after closure | PAGCOR KYC requirements; AMLA |
| Support and Communications Records | 3 years from last interaction | Contractual; legitimate interest |
| Responsible Gaming Records | Duration of self-exclusion + 5 years | PAGCOR responsible gaming obligations |
| Technical and Usage Logs | 12 months from collection | Legitimate interest (security; fraud prevention) |
| Marketing Preferences | Until consent is withdrawn or account closure | Consent |
Where lucky.ph is required by law to retain data beyond the periods above, we will comply with that legal requirement. The data retained for legal compliance purposes will not be used for any other processing purpose.
Lucky.ph implements a layered set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:
Your Role in Security: You are responsible for maintaining the confidentiality of your lucky.ph login credentials. Lucky.ph will never ask for your password via email, SMS, or phone call. If you receive such a request, it is a phishing attempt — report it to our support team immediately.
As a data subject under the Philippine Data Privacy Act of 2012 (RA 10173), you hold the following rights in relation to your personal data processed by lucky.ph:
You have the right to know whether lucky.ph holds personal data about you, and to receive a copy of this Privacy Policy at any time.
You have the right to request access to the personal data lucky.ph holds about you and to receive a copy of that data in a structured, readable format.
You have the right to request correction of any inaccurate, incomplete, or outdated personal data that lucky.ph holds about you.
You may request deletion of your personal data where it is no longer necessary for the purposes collected, subject to legal retention obligations under AMLA and PAGCOR requirements.
You have the right to object to processing of your personal data based on legitimate interests, including direct marketing. You may unsubscribe from marketing communications at any time.
You may request that lucky.ph provide your personal data in a commonly used, machine-readable format for transfer to another service provider where technically feasible.
To exercise any of the rights above, submit a written request to lucky.ph's Data Protection Officer at the contact details in Section 14. Lucky.ph will acknowledge your request within five (5) business days and provide a substantive response within fifteen (15) business days, extendable to thirty (30) business days for complex requests. Identity verification may be required before your request is processed.
If you are dissatisfied with how lucky.ph handles your data privacy rights request, you may lodge a complaint with the National Privacy Commission (NPC) of the Philippines through its official channels.
The lucky.ph platform uses the following categories of cookies and similar tracking technologies:
Strictly necessary and security cookies are deployed without requiring consent as they are essential to platform operation and account security. Performance and functional cookies are deployed subject to your consent, which you may provide or withdraw through the cookie preferences panel accessible on the lucky.ph platform.
You may also control cookies through your browser settings. Disabling all cookies will affect the functionality of the lucky.ph platform, and certain features may become unavailable.
Lucky.ph does not knowingly collect personal data from individuals under the age of 21. The platform is strictly restricted to adults aged 21 and above in accordance with PAGCOR regulations governing online gambling in the Philippines.
Age verification is conducted at the point of account registration and prior to processing any withdrawal. If lucky.ph becomes aware that personal data has been collected from a person under 21 years of age, that account will be suspended immediately, the personal data will be deleted from our active systems, and the matter will be referred to PAGCOR as required by law.
If you believe that lucky.ph may have inadvertently collected data from a minor, please notify our Data Protection Officer immediately at the contact details in Section 14.
In the event of a personal data breach that poses a risk to your rights and freedoms, lucky.ph will comply fully with the breach notification requirements under the Philippine Data Privacy Act and the NPC's Circular No. 16-03 (Personal Data Breach Management).
Specifically, lucky.ph will: notify the National Privacy Commission of any reportable breach within seventy-two (72) hours of becoming aware of it; notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights; document all breaches in our internal breach register regardless of whether NPC notification is required; and take immediate remediation steps to contain the breach and prevent recurrence.
Our Data Protection Officer oversees lucky.ph's breach response process and is the primary point of contact for both the NPC and affected players in the event of a breach.
Lucky.ph reserves the right to amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, regulatory guidance, or platform features. Material amendments will be communicated to you via your registered email address at least fourteen (14) days before the changes take effect, along with a clear description of what has changed.
Minor amendments — including editorial corrections, clarifications that do not alter your rights, and changes required by NPC guidance — may take effect immediately upon publication. The effective date at the top of this Policy will be updated accordingly.
Your continued use of the lucky.ph platform after the effective date of any amendment constitutes your acknowledgement of the revised Policy. If you do not agree with the amended terms, you may request account closure in accordance with the Terms and Conditions. Previous versions of this Privacy Policy are available upon request from the Data Protection Officer.
For any questions, requests, or complaints relating to this Privacy Policy or the processing of your personal data by lucky.ph, please contact our Data Protection Officer:
Data Protection Officer — lucky.ph
Email: [email protected]
Subject line: "Data Privacy Request – [Your Name]"
Response SLA: Acknowledgement within 5 business days; substantive response within 15 business days.
Support Hours: Monday to Sunday, 8:00 AM – 10:00 PM Philippine Standard Time (PHT)
If your privacy concern is not resolved to your satisfaction through lucky.ph's internal process, you have the right to lodge a formal complaint with the National Privacy Commission (NPC) of the Philippines. The NPC is the independent government authority responsible for administering and enforcing the Data Privacy Act of 2012. Details of the NPC's complaint process are available through the NPC's official government channels.
Lucky.ph is PAGCOR-authorized, DPA-compliant, and built to protect every Filipino player — your data, your winnings, and your experience. For adults 21 and above.
PAGCOR-Regulated · DPA-Compliant · 256-bit SSL · 21+ Only