1. Introduction
Win Lucky ("we," "us," "our") operates the online gaming platform accessible at winlucky.my. This Privacy Policy explains how we collect, use, store, share, and protect the personal information you provide when you register for and use the Win Lucky platform.
We are committed to handling your personal data responsibly and in full compliance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations, as enforced by the National Privacy Commission (NPC).
By registering an account or using Win Lucky in any way, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein. If you do not agree, please discontinue use of the platform.
Note for our players: This policy is written in plain English because we want you — our Kabayan players — to actually understand what happens with your data. No unnecessary legal jargon, no hidden surprises.
2. Personal Data We Collect
Depending on how you interact with Win Lucky, we may collect the following categories of personal data:
| Category | Examples |
|---|---|
| Identity Data | Full legal name, date of birth, government-issued ID number (e.g., PhilSys, passport, UMID, driver's licence) |
| Contact Data | Email address, mobile number, home address, city, province |
| Financial Data | GCash or Maya account number, bank account details (for withdrawals), transaction history, deposit and withdrawal amounts |
| Account Data | Username, hashed password, account balance, betting history, game preferences, bonus usage |
| Technical Data | IP address, device type, browser type and version, operating system, session duration, page views |
| Verification Data | Scanned copies of government IDs, selfie photos for identity verification, proof of address documents |
| Communications Data | Records of your interactions with our customer support team (live chat logs, email correspondence) |
We do not intentionally collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, or health data, unless explicitly required by law or regulatory compliance processes.
3. How We Collect Your Data
Win Lucky collects personal data through the following means:
- Direct interactions: When you register an account, complete KYC verification, make a deposit or withdrawal, contact customer support, or respond to surveys and promotions.
- Automated technologies: As you navigate the Win Lucky platform, we automatically collect technical data through cookies, web beacons, server logs, and similar tracking technologies.
- Third-party sources: We may receive data from payment processors (e.g., GCash, Maya, BDO), identity verification service providers, fraud prevention services, and analytics partners — all of whom are bound by confidentiality obligations.
We only collect data that is necessary for the purpose for which it is collected. We do not engage in excessive or unnecessary data collection.
4. Why We Use Your Data
Win Lucky processes your personal data for the following specific purposes, each grounded in a legitimate legal basis:
- Account setup and management: To create and maintain your Win Lucky account, verify your identity, and ensure one account per player.
- Transaction processing: To process deposits and withdrawals in Philippine Peso (₱), reconcile payments, and maintain accurate financial records.
- Legal and regulatory compliance: To meet our obligations under Philippine gaming regulations, anti-money laundering laws (AMLA), and data privacy requirements set by the NPC.
- Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, cheating, collusion, and unauthorised account access.
- Customer support: To respond to your enquiries, resolve disputes, and provide assistance via live chat and email.
- Platform improvement: To analyse usage patterns, troubleshoot technical issues, and continuously improve the Win Lucky experience for all Filipino players.
- Marketing and promotions: To send you relevant bonus offers, news, and promotional updates — but only if you have opted in. You may opt out at any time.
- Responsible gaming: To monitor gaming behaviour and intervene where necessary to support players who may be at risk of problem gambling.
We will never use your data to discriminate against you, make automated decisions that significantly affect your rights, or for purposes unrelated to operating the Win Lucky platform.
5. Who We Share Your Data With
Win Lucky does not sell your personal data. We share it only with trusted parties under strict confidentiality agreements, and only when necessary:
- Payment processors: GCash, Maya, GrabPay, Coins.ph, InstaPay, BDO, BPI, UnionBank, Visa, and Mastercard — to process deposits and withdrawals.
- Identity verification providers: Third-party KYC partners who help us verify government-issued IDs and confirm player identity.
- IT and hosting providers: Cloud infrastructure and server management companies who store and process data on our behalf under strict security protocols.
- Regulatory and law enforcement authorities: When required by Philippine law, court order, or lawful request from a government body (e.g., PAGCOR, AMLC, NPC).
- Fraud prevention services: Specialised providers that help us detect and prevent fraudulent accounts and transactions.
- Analytics partners: Anonymised and aggregated data may be shared with analytics services to help us understand platform usage — no personally identifiable information is included.
All third parties we work with are required to handle your data in accordance with applicable Philippine privacy laws and our data processing agreements.
6. Cookies and Tracking Technologies
Win Lucky uses cookies and similar technologies to operate the platform, improve performance, and personalise your experience. Here is a summary of the types of cookies we use:
- Essential Cookies: Required for the platform to function. These enable login sessions, maintain your cart, and ensure security. You cannot opt out of these.
- Functional Cookies: Remember your preferences (language, game layout, etc.) so you don't have to re-enter them each visit.
- Analytics Cookies: Help us understand how players use Win Lucky — which pages are visited most, where players drop off, etc. Data is aggregated and anonymised.
- Marketing Cookies: Used to show you relevant promotions on and off the platform. You can opt out of these at any time via your browser settings.
Most browsers allow you to control cookie settings. Disabling non-essential cookies may affect some features of the Win Lucky platform, but will not prevent you from playing.
7. Data Security
Win Lucky implements robust technical and organisational security measures to protect your personal data from unauthorised access, alteration, disclosure, or destruction. Our security framework includes:
- SSL/TLS encryption for all data transmitted between your device and our servers.
- AES-256 encryption for sensitive data stored in our databases, including financial information and identity documents.
- Multi-factor authentication (MFA) options for player accounts.
- Regular security audits and penetration testing by independent security firms.
- Strict access controls — only authorised Win Lucky personnel with a business need can access personal data, and all such access is logged.
- Incident response plan — in the event of a data breach, we will notify affected players and the National Privacy Commission within 72 hours, as required by law.
While we take every reasonable precaution, no digital system is completely impenetrable. We encourage you to use a strong, unique password for your Win Lucky account and to enable two-factor authentication where available.
8. Data Retention
Win Lucky retains personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Specific retention periods include:
- Active account data: Retained for the duration of your account relationship with Win Lucky, plus a minimum of five (5) years after account closure — as required by AMLA and gaming regulations.
- KYC and identity documents: Retained for a minimum of five (5) years from the date of verification or account closure, whichever is later.
- Transaction records: Retained for a minimum of five (5) years for financial audit and anti-money laundering compliance purposes.
- Customer support records: Retained for two (2) years from the date of the interaction.
- Marketing data: Retained until you withdraw your consent to receive marketing communications, or for a maximum of three (3) years from your last interaction with Win Lucky.
After the applicable retention period, your personal data will be securely deleted or anonymised so that it can no longer be linked back to you.
9. Your Privacy Rights
Under the Philippine Data Privacy Act of 2012, you have the following rights with respect to your personal data held by Win Lucky:
Right to Access
You can request a copy of the personal data Win Lucky holds about you, along with information on how it is being used.
Right to Rectification
If any of your personal data is inaccurate or incomplete, you have the right to request that we correct or update it.
Right to Erasure
You may request deletion of your personal data when it is no longer necessary for the purpose it was collected, subject to legal retention requirements.
Right to Object
You can object to the processing of your personal data for direct marketing purposes at any time. We will stop marketing communications immediately upon your request.
Right to Data Portability
You may request a copy of your personal data in a structured, commonly used, and machine-readable format so you can transfer it to another service.
Right to File a Complaint
If you believe Win Lucky has violated your privacy rights, you may file a complaint with the National Privacy Commission (NPC) of the Philippines.
To exercise any of these rights, contact our Data Protection Officer at privacy@winlucky.my. We will respond to verified requests within 15 business days.
10. Children's Privacy
Win Lucky is strictly for players who are 21 years of age or older. We do not knowingly collect personal data from individuals under 21. If we discover that a user under the minimum age has registered an account, we will immediately close the account and delete all associated personal data.
If you are a parent or guardian and believe your child has provided personal data to Win Lucky, please contact us immediately at privacy@winlucky.my.
11. Third-Party Links
The Win Lucky platform may contain links to third-party websites or services (such as payment gateways). This Privacy Policy applies only to the Win Lucky platform and does not cover how those third parties handle your data.
We encourage you to read the privacy policies of any third-party service you use in connection with Win Lucky, particularly your chosen payment provider.
12. Cross-Border Data Transfers
Win Lucky primarily processes data within the Philippines. However, some of our technology service providers and cloud infrastructure partners may be based outside the country. In such cases, we ensure that appropriate safeguards are in place to protect your personal data, in accordance with the requirements of the Philippine Data Privacy Act.
We will not transfer your personal data to any country that does not provide an adequate level of data protection without implementing appropriate contractual safeguards.
13. Changes to This Privacy Policy
Win Lucky reserves the right to update this Privacy Policy at any time. When we make material changes, we will notify registered players by email or through an in-platform notification. The revised policy will be posted on this page with an updated effective date.
We encourage you to check this page periodically to stay informed about how we protect your data. Your continued use of Win Lucky after any updates constitutes acceptance of the revised Privacy Policy.
14. Contact Us and Data Protection Officer
If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a privacy concern, you can reach our team through the following channels:
- Data Protection Officer (DPO): privacy@winlucky.my
- General Support: support@winlucky.my
- Live Chat: Available 24/7 on the Win Lucky platform
- FAQ: winlucky.my/faq
For complaints that we are unable to resolve to your satisfaction, you may escalate the matter to the National Privacy Commission of the Philippines via their official website or email.
Kami ay nandito para sa inyo. Our team takes every privacy concern seriously. If something doesn't feel right about how your data is being handled, please reach out — we will investigate and get back to you as quickly as possible.