luckon Privacy Policy

1. Data Controller Identity

The data controller responsible for your personal information collected through the luckon platform is the operator of luckon.ws, a PAGCOR-regulated online gaming platform serving Filipino players across the Philippines.

For all data privacy matters — including rights requests, complaints, and general enquiries — you may contact our Data Protection Officer (DPO) at [email protected]. Please use the subject line "Data Privacy Request" so your message is routed to the correct team without delay.

luckon is registered as a personal information controller with the National Privacy Commission (NPC) of the Philippines, in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

2. Personal Data We Collect

luckon collects personal data through multiple channels — directly from you when you register, deposit, or contact support; automatically when you use the Platform; and from trusted third parties such as payment processors and identity verification providers. The categories of data we collect are described below.

We do not collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation — except where the collection of health-related information is directly relevant to a responsible gaming assessment at the User's own initiative.

3. How We Use Your Personal Data

luckon uses your personal data for the following clearly defined purposes:

• Account Creation & Management — to register your luckon account, verify your identity, maintain your account settings, and process account closure requests;
• Payment Processing — to process deposits and withdrawals via GCash, Maya, QR Ph, BPI, BDO, Metrobank, InstaPay, PesoNet, and 7-Eleven CLiQQ, and to match payment records for dispute resolution;
• KYC & AMLA Compliance — to verify your identity as required by PAGCOR licensing conditions and to comply with the Anti-Money Laundering Act of the Philippines (Republic Act No. 9160 as amended), including transaction monitoring and suspicious activity reporting to the Anti-Money Laundering Council (AMLC);
• Gaming Services Delivery — to operate and personalize your gaming experience, including game history, balance management, and responsible gaming tool functionality;
• Customer Support — to respond to your enquiries, resolve disputes, and follow up on complaints submitted to luckon or escalated to PAGCOR;
• Fraud Prevention & Security — to detect, investigate, and prevent unauthorized access, account fraud, bonus abuse, multi-accounting, and other prohibited conduct as defined in our Terms & Conditions;
• Legal & Regulatory Compliance — to meet our obligations under PAGCOR licensing, Philippine tax law, AMLA, and the Data Privacy Act of 2012;
• Platform Improvement — to analyze aggregated, anonymized usage patterns to improve site performance, user experience, and game offering — no individual profiling for marketing purposes;
• Responsible Gaming Monitoring — to monitor gaming activity for signs of problematic behavior and to apply or verify self-exclusion, deposit limits, or cooling-off restrictions at your request or as required by PAGCOR directives.

luckon does not use automated decision-making or profiling in a manner that produces legal or similarly significant effects on you as a user, without providing you the opportunity to seek human review.

4. Legal Basis for Processing

Under the Data Privacy Act of 2012 (RA 10173), luckon processes your personal data on the following legal grounds:

• Contractual Necessity — processing required to fulfill our obligations under the luckon Terms & Conditions that you accepted upon registration, including account management, payment processing, and gaming services delivery;
• Legal Obligation — processing required to comply with PAGCOR licensing requirements, AMLA obligations, NPC reporting requirements, and other applicable Philippine laws and regulations;
• Legitimate Interests — processing necessary for fraud prevention, platform security, abuse detection, and anonymized analytics, provided such interests are not overridden by your data privacy rights;
• Consent — where we rely on consent (e.g., for optional marketing communications), you may withdraw consent at any time by contacting [email protected] or updating your account notification preferences. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

5. Data Sharing & Disclosure

luckon does not sell your personal data. We share your personal data only in the following circumstances and only to the minimum extent necessary:

• PAGCOR & Regulatory Authorities — we are required to share player data, gaming activity records, and KYC documentation with PAGCOR upon request as a condition of our operating license. We also comply with data requests from the Anti-Money Laundering Council (AMLC), Bureau of Internal Revenue (BIR), and other Philippine government agencies where legally compelled;
• Payment Service Providers — we share necessary transaction data with payment processors (GCash/Maya/bank partners) to facilitate deposits and withdrawals. These providers act as independent data controllers for their own services and are governed by their own privacy policies;
• Identity Verification Partners — we may use third-party KYC verification providers to authenticate government IDs and verify Philippine addresses. These providers are contractually bound by data processing agreements and may not use your data for their own purposes;
• Technology & Hosting Providers — cloud infrastructure, database hosting, and cybersecurity service providers who process data on our behalf under strict data processing agreements and security standards;
• Game Content Providers — game software providers may receive anonymized session data (no personally identifiable information) for game performance analytics and RTP compliance audits;
• Law Enforcement — we will disclose personal data to Philippine law enforcement authorities where required by a valid court order, subpoena, or legal process under Philippine law;
• Business Transfers — in the event of a merger, acquisition, or sale of substantially all of luckon's assets, your personal data may be transferred to the successor entity, subject to the same privacy protections. You will be notified of any such transfer via the email address on your account.

6. Cookies & Tracking Technologies

The luckon platform uses cookies and similar tracking technologies to operate key platform functions, maintain your session, prevent fraud, and analyze aggregate usage patterns. When you first visit luckon.ws, you will be presented with a cookie consent notice.

We use the following categories of cookies:

• Strictly Necessary Cookies — essential for the platform to function. These include session authentication tokens, CSRF protection cookies, and responsible gaming tool state. These cannot be disabled without breaking core platform functionality;
• Functional Cookies — remember your language preference, display settings, and notification preferences to personalize your experience across sessions;
• Analytics Cookies — used to collect anonymized, aggregated data about how users interact with luckon pages — pages visited, time on site, navigation paths — to help us improve the platform. No individual user profiles are built from analytics data;
• Security Cookies — support fraud detection and suspicious session identification, including device fingerprinting signals used to identify multi-account behavior.

luckon does not use third-party advertising cookies or cross-site tracking cookies. You may manage cookie preferences through your browser settings at any time, though disabling strictly necessary cookies will prevent you from logging into or using the platform.

7. Data Retention

luckon retains your personal data for as long as necessary to fulfill the purposes described in this Policy, subject to the following minimum retention periods required by Philippine law and PAGCOR regulation:

• Account & Identity Records — retained for a minimum of five (5) years from account closure, in compliance with AMLA record-keeping requirements;
• Financial Transaction Records — retained for a minimum of five (5) years from the date of the transaction, as required under AMLA and BIR regulations;
• Gaming Activity Logs — retained for a minimum of three (3) years from the date of the gaming session, for dispute resolution and PAGCOR audit purposes;
• KYC Documents — retained for the duration of the account relationship plus five (5) years following account closure;
• Support Communications — retained for two (2) years from the date of the last communication, for quality assurance and dispute reference purposes;
• Responsible Gaming Records — self-exclusion records are retained for a minimum of seven (7) years to prevent the circumvention of exclusion through new account creation.

After applicable retention periods expire and there is no overriding legal basis for continued retention, luckon will securely delete or anonymize your personal data. Anonymized data — where individual identification is no longer possible — may be retained indefinitely for statistical and platform improvement purposes.

8. Data Security

luckon implements technical and organizational security measures proportionate to the sensitivity of the personal data we process. Our security program includes the following controls:

• Encryption in Transit — all data transmitted between your browser and luckon servers is encrypted using TLS 1.2 or higher. We enforce HTTPS across all platform pages and APIs;
• Encryption at Rest — sensitive personal data including identity documents, KYC records, and financial data is encrypted at rest using AES-256 encryption;
• Access Controls — access to personal data within luckon systems is restricted to authorized personnel on a strict need-to-know basis. All internal access is logged and subject to periodic review;
• Two-Factor Authentication — luckon supports and encourages 2FA for all user accounts. Internal system access by luckon staff requires 2FA;
• Penetration Testing — the luckon platform undergoes periodic independent security assessments including penetration testing and vulnerability scanning;
• Incident Response — luckon maintains a documented data breach incident response plan aligned with NPC Circular 16-03 requirements, including 72-hour breach notification obligations.

9. Cross-Border Data Transfers

The luckon platform primarily stores and processes personal data within the Philippines or in data centers serving the Philippine market. Where data processing involves service providers located outside the Philippines — such as international cloud infrastructure providers or global game software vendors — luckon ensures that such transfers are covered by appropriate safeguards.

In accordance with NPC guidelines, cross-border transfers of personal data from the Philippines are conducted only where:

• The receiving country or organization provides an adequate level of data protection as recognized by the NPC; or
• We have implemented contractual safeguards — including NPC-compliant data processing agreements or binding corporate rules — that ensure the receiving party protects your data to a standard equivalent to RA 10173; or
• The transfer is necessary for the performance of a contract with you (e.g., processing an international payment); or
• Your explicit consent to the transfer has been obtained.

If you have questions about the specific safeguards in place for any cross-border data transfer involving your personal information, you may request details from our DPO at [email protected].

10. Your Data Rights Under RA 10173

As a data subject under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the following rights with respect to your personal data held by luckon:

• Right to Be Informed — you have the right to be informed whether luckon holds personal data about you, and to receive a description of the data, the purpose of processing, and any third parties to whom it may be disclosed;
• Right to Access — you have the right to request a copy of the personal data luckon holds about you, provided in a readable format within thirty (30) days of a verified request;
• Right to Correction — if any personal data held by luckon is inaccurate, incomplete, or outdated, you have the right to request correction. In some cases, luckon may require supporting documentation to verify the corrected information;
• Right to Erasure / Blocking — you have the right to request the deletion or blocking of personal data where it is no longer necessary for the purpose for which it was collected, or where processing was unlawful — subject to luckon's overriding legal obligations under AMLA and PAGCOR regulations that may require retention;
• Right to Object — you have the right to object to processing of your personal data on the basis of legitimate interests, or where data is used for direct marketing purposes. Where objection is upheld, luckon will cease the relevant processing;
• Right to Data Portability — you have the right to receive your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contractual necessity, and to transmit that data to another controller;
• Right to Lodge a Complaint — if you believe luckon has processed your personal data in violation of RA 10173, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines.

To exercise any of the above rights, please submit a written request to [email protected] using the subject line "Data Rights Request — [Your Request Type]". We will acknowledge your request within five (5) Philippine business days and aim to fulfill verified requests within thirty (30) days. We may ask you to verify your identity before processing your request.

11. Children's Privacy & Age Restriction

If luckon discovers or is notified that personal data has been collected from a person under 21 years of age, we will immediately suspend the relevant account, delete the associated personal data, and report the incident to PAGCOR as required. Any funds deposited by an under-age user will be returned to the source payment method following identity verification, and may be reported to relevant Philippine authorities.

If you are a parent or guardian and believe that a minor under your care has registered on luckon, please contact our support team at [email protected] immediately. We take these reports extremely seriously and will act on them as a priority.

12. Updates to This Privacy Policy

luckon reserves the right to update, amend, or replace this Privacy Policy at any time to reflect changes in our data processing practices, applicable Philippine law, NPC guidance, or PAGCOR regulatory requirements.

When we make material changes — meaning changes that significantly affect how your personal data is collected or used — we will notify registered account holders via the email address on their account at least seven (7) days before the changes take effect. We will also update the "Last Updated" date at the top of this Policy.

For minor, non-material changes such as typographical corrections or clarifications that do not affect the substance of our data practices, updates may take effect immediately upon publication on luckon.ws. We encourage you to review this Policy periodically. Continued use of the luckon platform after the effective date of any amended Policy constitutes your acceptance of the revised terms.

13. Contact & Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or luckon's data processing practices, please contact our Data Protection Officer:

• Email: [email protected] — subject line: "Data Privacy Request"
• Live Chat: Available 24/7 via the luckon platform — ask to be connected to the Data Privacy team
• Response Time: We aim to acknowledge all data privacy enquiries within five (5) Philippine business days

If you are not satisfied with luckon's response to a data privacy concern, you have the right to escalate your complaint to the National Privacy Commission (NPC) of the Philippines through its official complaints procedure.