Privacy Policy Lucky55 — Our Commitment to Protecting the Personal Data of Malaysian Members

Lucky55 (operating through lucky55.express) is the personal data controller responsible for the information you provide when using our platform. This Privacy Policy has been drawn up to fulfil lucky55's obligations under Malaysia's Personal Data Protection Act 2010 (PDPA) and covers all aspects of the collection, processing, storage, and transfer of members' personal data.

This policy applies to all individuals who interact with lucky55 in any capacity — including unregistered website visitors, registered members, applicants in the process of registering, and former members whose accounts have been closed. By using the lucky55 platform, you acknowledge that you have read, understood, and agreed to the data handling practices described in this document.

Lucky55 operates on the fundamental principle that your personal data belongs to you. Our role is that of a trustee — we manage that data on your behalf to keep our services running properly, and we never use it for any other purpose without your consent. You will be notified of any material changes to this policy at least 14 days before they take effect, via your registered email.

Lucky55 collects your personal data through several channels — information you provide directly during registration or platform use, information collected automatically as you use our services, and in certain cases, information obtained from legitimate third parties such as identity verification providers.

Children's Information

Lucky55 does not knowingly collect personal data from individuals under the age of 18. If we discover that a child's data has been collected without valid parental or guardian consent, we will take immediate steps to delete that data and close the associated account. Parents or guardians who believe their child has registered a lucky55 account should contact us immediately at support@lucky55.express.

Lucky55 processes your personal data on one or more lawful bases recognised under PDPA 2010 — whether to perform a contract with you, fulfil a legal obligation, pursue a legitimate interest that does not override your privacy rights, or on the basis of your consent. Below is a detailed breakdown of our data use purposes:

Lucky55 does not sell or rent members' personal data to third parties for their own commercial purposes. Your data may be shared with the following parties only in the circumstances stated:

Our Service Providers

Lucky55 works with third-party service providers that help us operate the platform. These include live casino game providers (such as Evolution Gaming, Pragmatic Play Live, SA Gaming), payment processors, cloud computing service providers, and customer support service providers. All these providers are bound by strict data processing agreements and are only permitted to use your data for purposes we specify.

Authorities and Regulatory Bodies

Lucky55 may disclose your personal data to Malaysian authorities or the relevant regulatory bodies when required by law, court order, or regulatory directive. In such cases, we will endeavour to notify you in advance unless we are legally prohibited from doing so.

Business Transfer

In the event that lucky55 is involved in any merger, acquisition, or asset transfer, members' personal data may be transferred to the new entity. In such cases, you will be notified, and the receiving entity will be bound by a privacy policy at least equivalent to this one.

Protecting members' personal data is a responsibility lucky55 takes very seriously. We implement a range of technical and organisational security measures to ensure your data remains safe:

Technical Security Measures

• 256-bit SSL/TLS Encryption: All communications between your device and lucky55's servers are encrypted using the latest TLS 1.3 protocol.
• Encryption of data at rest: Sensitive personal data is stored in encrypted form in our databases, including passwords stored using strong hashing algorithms.
• Two-Factor Authentication (2FA): lucky55 provides and encourages the use of 2FA on all member accounts to prevent unauthorised access.
• Real-time security monitoring: Intrusion detection systems (IDS) and intrusion prevention systems (IPS) monitor network traffic 24/7 to detect suspicious activity.
• Periodic security audits: Lucky55 conducts penetration testing and independent security audits at least once a year to identify and address vulnerabilities.

Organisational Security Measures

• Principle of minimum access rights — staff are only granted access to data necessary for their specific duties.
• Mandatory data protection training for all lucky55 staff who handle personal data.
• Clear procedures for handling data requests, privacy complaints, and security incidents.
• Binding confidentiality agreements for all lucky55 staff and contractors.

While lucky55 takes all reasonable precautions, no digital security system is 100% foolproof. We encourage members to take their own protective steps, such as using strong passwords, not sharing login credentials, and reporting any suspicious activity to us promptly.

Lucky55 uses cookies and similar tracking technologies to keep the platform running smoothly, enhance the user experience, and understand how members use our services. The following are the types of cookies we use:

Essential Cookies

These cookies are essential for the core functions of the lucky55 platform — including maintaining your login session, securing transactions, and preventing fraud. Without them, the platform cannot operate properly. Essential cookies cannot be disabled.

Performance & Analytics Cookies

Lucky55 uses performance cookies to understand how members interact with the platform — which pages are visited most frequently, where members encounter technical issues, and general usage flows. This data is used in aggregated, anonymised form to improve the platform. You can opt out of these cookies via the platform's cookie settings.

Functional Cookies

Functional cookies allow lucky55 to remember your preferences, such as your preferred language, display settings, and login details (if you choose to save them). This makes for a smoother experience without needing to reconfigure your preferences each time you log in.

Lucky55 does not retain personal data for longer than necessary. Retention periods are determined based on the purpose for which the data was collected, applicable legal requirements, and legitimate business interests. The following are general retention period guidelines:

• Active account data: Retained for the duration of the active account and 12 months after closure for dispute resolution purposes.
• Financial transaction records: Retained for 7 years after the transaction, in line with Malaysia's financial and anti-money laundering legal requirements.
• KYC Documents: Retained for 5 years after account closure in accordance with applicable AML requirements.
• Customer support communication logs: Retained for 2 years for quality control and dispute resolution purposes.
• Technical and security logs: Retained for 90 days in active state, then archived for a further 12 months before deletion.
• Marketing preference data: Retained until you withdraw your consent or close your lucky55 account.

Once the relevant retention period has ended, personal data will be securely deleted or anonymised so that it can no longer be linked back to you personally. Anonymised data may be retained indefinitely for statistical and analytical purposes.

Under Malaysia's PDPA 2010 and lucky55's privacy policy, you have the following rights regarding your personal data. We are committed to processing all rights requests within 30 calendar days:

Some service providers that help lucky55 operate the platform may be based outside Malaysia or store data there. For example, cloud computing service providers or international live casino game providers may store data in data centres across the Asia region or Europe.

In all such cases of data transfer, lucky55 ensures equivalent protections are in place through the following mechanisms:

• Data processing agreements incorporating internationally recognised standard data protection clauses
• Verification that the recipient country has equivalent data protection laws
• Data protection impact assessments (DPIA) for high-risk transfers
• Regular audits of third-party providers to ensure ongoing compliance

Lucky55 does not transfer the personal data of Malaysian members to countries that lack an adequate level of data protection without appropriate additional safeguards in place. A current list of countries and providers that may receive your data can be requested via support@lucky55.express.

Lucky55 has appointed a Data Protection Officer (DPO) responsible for overseeing all matters relating to data protection and privacy. If you have any questions, concerns, or complaints about how lucky55 handles your personal data, you may reach us through the following channels:

If you are not satisfied with how lucky55 has handled your privacy complaint after following our internal procedure, you have the right to lodge a complaint with Malaysia's Department of Personal Data Protection (JPDP) or the relevant regulatory body under the Ministry of Communications and Digital Malaysia.

We will always strive to resolve any privacy concerns fairly, transparently, and within a reasonable timeframe. Your privacy is a priority for lucky55 — not merely a legal obligation.